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ABSTRACT 


Elements of an advanced functional framework for reusable rocket engine propulsion 
system control are presented for the space shuttle main engine (SSME) demonstration case. 
Functional elements of the baseline functional framework are defined in detail. SSME 
failure modes are evaluated and specific failure modes identified for inclusion in the 
advanced functional framework diagnostic system. Active control of the SSME start 
transient is investigated, leading to the identification of a promising approach to mitigating 
start transient excursions. Key elements of the functional framework are simulated and 
demonstration cases are provided. Finally, the advanced functional framework for control 
of reusable rocket engines is presented. 
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SECTION 1 PROGRAM OVERVIEW 


The objective of this program is to develop a functional framework for control of reusable 
rocket engine propulsion systems used on future launch vehicles. The framework applies to a 
variety of of propulsion systems and provides, in the design, the capability to enhance engine 
performance with increased reliability, durability, and maintainability. This capability is 
achieved through improved control algorithms, additional instrumentation, and additional 
actuation hardware. Specific details of the framework functional elements are based on an 
SSME derivative engine to facilitate validation on the SSME technology testbed. 

The Reusable Rocket Engine Intelligent Control System Framework Design (RREICS) 
program was funded by the NASA Lewis Research Center in Cleveland, Ohio and was 
monitored by Dr. W. Merrill. 

The RREICS framework design program is one element of an integrated program undertaken 
by NASA-LeRC to develop an advanced control system for future reusable rocket engine 
propulsion systems. Other related efforts include the development of a real-time diagnostic 
system framework (NASA-LeRC), development of specific diagnostic capabilities (under 
contract to NASA-LeRC), development of detailed fatigue damage models (NASA-LeRC), and 
advanced control concepts for reusable rocket engines (NASA-LeRC). 

The RREICS program is divided into two phases. In the phase I program (Re:l), the 
requirements for a RREICS functional framework were defined and candidate functional 
capabilities were identified. The candidate functional capabilities were then evaluated using a 
figure of merit developed in the RREICS program. Based on the figure of merit evaluations, 
functional capabilities for the framework were selected and an integrated functional framework 
was synthesized. The phase I program resulted in a functional framework for control of 
reusable rocket engine propulsion systems within the constraints of near term capabilities. 

The Reusable Rocket Engine Intelligent Control System Framework Design phase II program 
was a 12 month continuation of the phase I contract. The objectives of the RREICS Phase II 
program were to demonstrate and further define elements of a functional framework for 
integrated, adaptable control of reusable rocket engines. 

The ICS phase II program consisted of five relatively independent tasks: 

1. Definition of the baseline functional framework (BFF) to the next level of detail, 

2. Definition of specific SSME diagnostic capabilities, 

3. A feasibility study of closed loop control during the SSME start transient, 

4. Demonstration of fundamental ICS concepts using dynamic system simulations, and 

5. Definition of an ICS advanced functional framework (AFF). 
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SECTION 2 INTRODUCTION 


Conventional rocket engine propulsion systems are a collection of independent engines. Each 
engine is controlled to the same commanded power level and is operated autonomously. In this 
configuration, the reliability and useful life of the engine cluster is completely dictated by the 
"weak link" in the system. The objective of the Reusable Rocket Engine Intelligent Control 
System (RREICS) functional framework design is to increase the reliability, extend the useful 
life, and increase the performance of the engine cluster through new control schemes, 
diagnostic capabilities, and actuation. 

The RREICS framework describes a controller that controls the rocket engine cluster as a 
single system rather than as a collection of independent engines and allows for accommodation 
of engine degradations at the engine level without affecting the propulsion system output. 
Control of the engine cluster as a single system enables shortcomings in the operation of an 
individual engine to be mitigated by offloading some of the workload to other engines. The 
result is that the "weak link" is operated at lower stress levels, effectively increasing the 
reliability and useful life of the rocket engine cluster. Engine stress levels are further reduced 
by functional elements at the engine level that respond to the engine operating conditions. 

The effectiveness of engine level functions to increrase engine reliability, extend engine life, 
and increase engine performance is limited by the highly coupled engine configuration. Only 
relatively minor adjustments to the engine are possible within the constraints of thrust and 
mixture ratio control. However, propulsion level coordination of the engine cluster enables 
significant increases in the overall propulsion system reliability, useful life, and performance as 
described in this report. This report demonstrates fundamental concepts used in the framework 
and describes the benefits and limitations expected of each functional element 

Section 3 describes the baseline functional framework at the tier two level of detail. The 
function of each element in the framework is illustrated and a description is included. 

Section 4 evaluates the SSME failure modes and effects analysis (FMEA) and critical items list 
(CIL). Specific diagnostic capabilities for the RREICS are identified and characterized to 
include required engine measurements, failure severity, and failure likelihood. 

Section 5 discusses the feasibility of closed loop control during the SSME start sequence to: 

- desensitize the system to engine parameter variations 

- desensitize the system to external perturbations or noise 

- improve the system performance 

- increase the engine reliability 

- reduce the SSME maintenance costs 

Several approaches by which closed loop control may be used to increase the SSME 
performance and safety during startup are evaluated to determine if such closed loop control is 
possible. 

Section 6 uses a dynamic model of the SSME and simplified RREICS functions to demonstrate 
the feasibility and utility of several fundamental concepts in the framework. Concepts 
demonstrated are: 1) the ability to control engine variables other than thrust and mixture ratio 
while maintaining a specified thrust and mixture ratio, 2) the ability to rapidly and smoothly 
change engine variables using a multivariable controller, and 3) the ability to coordinate a three 
engine cluster using downthnist factors as feedback. Since the goal of the simulation effort is 
to demonstrate feasibility, no effort to optimize the control gains was expended beyond that 
required to demonstrate the control feasibility. 
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Finally, in Section 7, the advanced functional framework is presented and each functional 
element is described. 


R1/RD91-158 


PAGE 3 



SECTION 3 DETAILED BASELINE FUNCTIONAL FRAMEWORK 


The baseline functional framework (BFF) defined in Phase I of this contract [Re:l] was 
modified in Phase II to clearly delineate the ICS diagnostic functions. Additionally, each 
functional element of the modified BFF was further defined to identify the functional level one 
tier below that presented in the phase I BFF framework. 

3.1 Baseline Functional Framework Revision 2.3 

In the BFF Rev. 2.2 (Re:l), the engine level diagnostics are distributed between the Engine 
Diagnostics and Status (EDS) and Life Extension Coordinator (LEC) functions. The BFF Rev 

2.2 EDS and LEC functions are replaced by three functional elements in the BFF Rev. 2.3: 1) 
Engine Diagnostics, 2) Engine Coordination, and 3) Engine Status. The modified BFF, 
identified as Revision 2.3, is shown in Figure 3-1. The changes made to create BFF Rev. 2.3 
do not alter the overall function of the phase I BFF Rev. 2.2. The only difference is that a 
distinct and complete engine diagnostic function has been defined. 

The Engine Diagnostics function represents all of the engine level diagnostics. Two distinct 
categories of diagnostics are identified in the BFF: 1) diagnostics of conditions which the 
engine can resolve or mitigate without changing thrust or mixture ratio (denoted by a C prefix 
in Figure 3-1), and 2) diagnostics of conditions that cannot be successfully mitigated without a 
change in thrust or mixture ratio (denoted by an F prefix in Figure 3-1). The distinction 
between diagnostic functions is made since the C class of conditions can be handled by the 
engine level while the F class of conditions require intervention by the propulsion level 
coordinator. 

The Engine Coordinator functions interprets the C class diagnostic information and engine 
variables to identify control actions that optimize the engine operating state according to a set of 
adaptable rules. The Engine Coordinator has authority over the F7V, CCV, and LPOTV 
valves only. In addition to directly controlling the F7V, CCV, and LPOTV, the Engine 
Coordinator modifies the engine state by issuing a high pressure turbine temperature error to 
the Primary Actuator Command Generator. 

The Engine Status function interprets F class diagnostic information and issues an indication of 
overall engine risk/stress to the propulsion level coordinator. Additionally, the Engine Status 
function interprets C class diagnostic information since a severe C class condition would 
require intervention by the propulsion level coordinator to mitigate the problem. 

3.2 Tier 2 Baseline Functional Framework Descriptions 

The ICS framework is hierarchical in nature with major functional elements divided between a 
single propulsion level subsystem and engine level subsystems at each engine as shown in 
Figure 3-1. 

The propulsion level ICS acts to maintain vehicle propulsion parameters under both nominal 
and degraded conditions. Parameters include the overall vehicle thrust, thrust vector, and 
overall vehicle mixture ratio. Each of these parameters is held to the value commanded by the 
mission coordinator (a higher level control function) by reconfiguring individual engine 
operating states to accommodate propulsion system degradations. In addition, the propulsion 
level ICS is responsible for managing overall propulsion system concerns such as propellent 
tank pressurization. 
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The engine level ICS implements the propulsion level commands (thrust, mixture ratio, gimbal 
angle) in the manner that is least stressful to the engine. In addition, alternate control modes 
are employed, at the engine level, to meet propulsion level commands in the event of a 
degraded control system. Details of each functional element are provided in the following 
descriptions. 

PROPULSION LEVEL FUNCTIONS 
Thrust Vector Coordinato r (Figure 3-2) 

The thrust vector coordinator is responsible for achieving and maintaining the vehicle thrust 
vector required for mission completion. To achieve the required thrust vector, the coordinator 
commands the thrust level and gimbal angles of each engine. The thrust vector is maintained 
by comparing the required thrust vector to the estimated thrust vector and modifying the engine 
commands to resolve any discrepancies. 

Since the mission is dependent on the total thrust vector (not individual engine thrust vectors) 
the coordinator has some degree of flexibility in the position and thrust assigned to each 
engine. For example, three engines at 100% are equivalent to two engines at 109% and one at 
82% (as far as the vehicle is concerned). Therefore, the primary coordination role of the thrust 
vector coordinator can be described as ensuring that the vector sum of individual engine thrust 
vectors equals the required vehicle thrust vector. 

The thrust vector coordinator has control of all aspects of engine operation that influence the 
thrust vector, including: thrust, gimbal position, engine lockups, and cutoffs. However, to 
avoid continuous, minor changes in engine levels, a threshold must generally be exceeded 
before any action is taken. If an engine degraded status flag indicates that an engine is unable 
to implement thrust level changes, the thrust vector coordinator will freeze the thrust command 
for that engine at its current level. This becomes an additional constraint to be considered in the 
thrust vector calculations. 

Relative engine thrusts are based on minimizing the downthrust factors and maximizing 
specific impulse for the engine cluster while still achieving the required thrust vector. Both the 
total thrust magnitude and direction of the thrust vector constrain the possible thrust distribution 
among the cluster. For example, it may be possible to meet the thrust magnitude requirement 
and still downthrust an engine but a failed gimbal actuator could make it impossible to 
downthrust the engine and still meet the directional requirement Therefore, the status of each 
gimbal actuator, estimated engine thrusts, downthrust factor of each engine, and specific 
impulse of each engine contribute to the thrust distribution commands. 

Decisions to allow an engine to run, lockup an engine, or cutoff an engine are based on the 
relative risk to the mission. The coordinator risk assessment considers the cutoff factors of 
other engines, engine redlines, results of upthrusting other engines, time of flight remaining, 
and the ability to maintain commanded thrust vector (gimbal status, available upthrust 
capabilities). For example, the risk associated with engine cutoff is significantly higher after 
the first engine has been cutoff. Therefore, it is expected that a more serious degradation (i.e. 
higher failure risk) would be required before a second engine was cutoff. 

Engine cutoff signals are issued if the engine cutoff factor is sufficiently large that the risk of 
catastrophic failure outweighs the potential benefits of continued operation. If an engine 
indicates a failure risk (large cutoff factor) the coordinator compares it to an estimated risk 
associated with engine cutoff and chooses the less risky option. The coordinator also has the 
option of locking the engine in its current state if the cutoff factor is trending towards an 
unacceptable limit. For example, if an engine redline measurement is approaching its cutoff 
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limit, the thrust vector coordinator may elect to lockup the engine rather than allowing it to be 
cutoff. Once locked, the thrust value may change, due to changing inlet conditions, and the 
estimated engine thrust becomes a constraint to be considered while maintaining the required 
thrust vector. Additionally, if the estimated risk associated with engine cutoff is so large that 
engine cutoff directly results in a loss of mission, the thrust vector coordinator issues a redline 
inhibit command to the engine level diagnostics to eliminate the possibility of cutoff under any 
circumstances. 

Fuel Utilizati on Coordinator (Figure 3-31 

The coordination task is one of maintaining the weighted average of engine mixture ratios 
(weighted by thrust) equal to the commanded vehicle mixture ratio. 

The fuel utilization coordinator is responsible for achieving and maintaining the vehicle mixture 
ratio at its commanded value. To achieve the commanded mixture ratio, the coordinator issues 
mixture ratio commands to each engine. The mixture ratio is maintained by comparing the 
commanded mixture ratio to the estimated mixture ratio and modifying the engine commands to 
resolve any discrepancies. If an engine degraded status flag indicates that an engine is unable 
to implement mixture ratio changes, the fuel utilization coordinator will freeze the mixture ratio 
command for that engine at its current level. The basic strategy is to identify engines that 
cannot change mixture ratio. These include engines that have been locked or those indicating a 
degraded status. The weighted mixture ratio for each of these engines is determined. Then, 
the mixture ratio required to make the weighted average of the cluster equal to the vehicle 
mixture ratio command is calculated for the remaining engines. The appropriate mixture ratio 
command is issued to each engine. 

Tank Pressu re Coordinator (Figure 3-41 

The tank pressure coordinator is responsible for maintaining the vehicle propellent tank 
pressures at their predetermined values. The tank pressure is maintained by comparing the 
desired tank pressure to the measured tank pressure and issuing FTV and OTV commands to 
resolve any discrepancies. The coordination task consists of determining the pressure error in 
each tank, estimating the change in recirculation flow required to resolve the error, and 
determining the FTV and OTV commands required to implement the change in total 
recirculation flow. The contribution to the total recirculation flow, for a given change in the 
FTV or OTV position, is dependent on the thrust of the associated engine. Therefore, the tank 
pressure coordinator considers the required recirculation flow, thrust of each engi ne, current 
position of FTV and OTV for each engine, lockup status of each engine, and FTV and OTV 
status for each engine in determining the required actuator commands. 

Propulsion Diagnostics and Status (Figure 3-5) 

The propulsion diagnostics and status function provides estimates of the measured vehicle 
thrust vector and mixture ratio to the appropriate coordinators. Diagnostic and status 
information required for mission level decisions are passed to the mission coordinator. These 
include: vehicle thrust, mixture ratio, propellent utilization rate, remaining propellents, and a 
propulsion system risk factor. In addition, the propulsion diagnostic and status function 
responds to risk assessment requests from the mission coordinator. 

The vehicle thrust vector is estimated by the vector sum of individual engine thrust vectors. 
Individual thrust vectors are determined using the estimated thrust from each engine and 
measured gimbal angles. The rate of propellent utilization is directly measured by vehicle 
propellent flowmeters. Mixture ratio is determined by the ratio of the measured propellent 
flowrates. If a vehicle flowmeter fails, the sum of the engine flowrates is used to estimate the 
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missing data. Remaining propellents are determined from tank level measurements. If level 
indicators are lost, subsequent data is estimated by subtracting the integral of the the measured 
flowrate from the last known value of remaining propellent. 

A propulsion system risk factor is used to estimate the risk of operating at the current thrust 
vector relative to possible abort modes. Issues that impact the risk factor for a specified thrust 
vector include: the ability to achieve that thrust vector (gimbal and engine statuses), and the 
thrust, cutoff factor, degraded status, lockup status, and cutoff status for each engine. For 
example, a configuration where one engine has already been cutoff and a second is indicating 
an increasing cutoff factor would have a high risk factor. An abort mode in which the second 
engine could be cutoff, if the cutoff factor continues to increase, would have a much lower risk 
factor. 

Thrust vectors required to implement the possible abort modes are received from the mission 
coordinator and a propulsion system risk factor is determined for the current thrust vector and 
each abort mode. These values are sent to the mission coordinator. It is expected that other 
major vehicle subsystems (e.g. GNC, Payload Management) would also provide estimates of 
the relative risk associated with possible abort modes and thereby enable the mission 
coordinator to maximize the likelihood of mission success by minimizing the overall vehicle 
risk. For example, if a possible abort mode somewhat reduces the risk of catastrophic engine 
failure but greatly increases the risk of missing an acceptable orbit it would not be 
implemented. 


ENGINE LEVEL FUNCTIONS 
Engine Command Generator (Figure 3-6). 

The engine command generator is responsible for maintaining the local engine thrust and 
mixture ratio required by the propulsion level. Propulsion level commands to the engine are 
each compared to estimates of local thrust and mixture ratio and appropriate commands are 
issued for the turbopump discharge pressures. The discharge pressures influence propellent 
flows into the MCC. The commands are sent to the primary actuator command generator and 
are the fundamental control parameters for the engine. 

Primary Actuator Command Generator (Figure 3-7) 

The primary actuator command generator implements the turbopump discharge pressure 
commands. In addition, HPFT temperature is implemented as a secondary control variable 
since the OPFV enables a tradeoff between HPOT and HPFT temperatures. Based on the 
errors in each of these variables; FPOV, OPOV, and OPFV positions are determined and 
issued to the actuators. The control strategy calculates actuator positions resulting in no 
turbopump discharge pressure errors and minimizing the HPFT temperature error. If an 
actuator fails, HPFT temperature control is forfeited since it does not impact current mission 
success. The remaining two actuators are used to maintain turbopump discharge pressure 
control. For example, if the OPOV fails, turbopump discharge pressure errors are resolved 
using the FPOV and OPFV at the possible expense of the resulting turbine temperature. 

Thrust and Mixture Ratio Estimator (Figure 3-8.) 

The thrust estimate is based on MCC pressure and is corrected for MCC mixture ratio 
(estimated by MCC temperature). Redundant transducers are used in the MCC so that no 
alternate estimation technique is required for thrust. The primary estimate of engine mixture 
ratio is the ratio of measured oxidizer mass flow rate to fuel mass flow rate into the engine. 


RI/RD91-158 


PAGE 7 



Both flows are corrected for propellent temperatures as needed. Since redundant flowmeters 
pose additional risk to the engine, only single measurements are baselined. If a flowmeter 
fails, the mixture ratio is estimated analytically using the remaining flowmeter (this is the 
estimation technique currently used on the SSME). 

En gine Coor dinator (Figure 3-9) 

The Engine Coordinator function controls the F7V, CCV, and LPOTV to maintain certain 
engine parameters within specified ranges. The parameters selected for coordination, as well 
as the valves used to control the parameters, can be controlled with relatively little effect on the 
engine thrust and mixture ratio. The small perturbations in thrust and mixture ratio caused by 
the Engine Coordination function are accounted for by the Engine Command Generator and are 
therefore transparent to the propulsion level. 

Each parameter is compared to its current acceptable range and an error signal is generated to 
quantify the compliance with that range. If the parameter falls within its specified range, an 
error signal of 0.0 is issued. The response of each valve is determined by the weighted sum of 
the measured errors. The errors are weighted according to the relative change in the coinciding 
parameter effected by each valve. 

A nominal set of parameter ranges are defined to optimize engine performance, minimize wear 
and damage, and reduce the risk of engine failure. Alternate acceptable ranges are selected 
based on engine conditions indicated by the Engine Diagnostics function. 

The error weighting factors are different if the errors are resolved without using all three valves 
(F7V, CCV, LPOTV). To accommodate changes in error weighting factors, an alternate set of 
factors is selected if the F7V, CCV, or LPOTV are locked up by the Actuator Diagnostics 
function. 

En gine Diagnostics (Figure 3-1Q \ 

The Engine Diagnostics function reduces engine measurements to quantified conditions and/or 
degradations of engine components that the Engine Status Function and Engine Coordinator 
can interpret. Examples of the diagnostic capabilities required are shown in Figure 3- lb, 
while a more complete list is developed in Section 4.0. 

Actuator Diagnostics. Gimbal Diagnostics (Figure 3-111 

The status of each actuator is monitored by the actuator diagnostics module. Actuator 
commands from the primary actuator command generator, the life extension coordinator, the 
tank pressure coordinator, and the valve sequence coordinator are used to drive actuator 
models. The model response is compared to the measured actuator response (monitored using 
position indicators). Unresponsive actuators are identified as "failed" and locked in their 
current positions. If a lockup command is received from the thrust vector coordinator, all 
engine control actuators are locked at their current positions. The gimbal actuator diagnostics 
are also model based and are the same as the actuator diagnostic functions described above. 

Engine Status (Figure 3-12) 

The engine status function evaluates key engine health indicators, reports the engine status to 
the propulsion level controller, and handles engine redlines. Key status indicators sent to the 
propulsion level are the estimated mixture ratio, the estimated thrust, the specific impulse of the 
engine, the heat exchanger status, and health indicators (cutoff factor, downthrust factor, and 
degraded status flag). 
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Redlines are handled by the Engine Status function. If a redline value is exceeded, a cutoff 
command is directly issued to the valve sequence coordinator. This is the only engine level 
cutoff capability and serves as an engine saving "reflex" in the event of rapid engine failures. 
However, this reflex can be inhibited by the thrust vector coordinator to prevent engine cutoffs 
that result in a loss of mission. 

In addition, the Engine Status functions calculates engine health parameters that act as 
recommendations to the propulsion level ICS functions. The intention of this feature is to 
reduce the large amounts of engine data and send only "status" type parameters to the 
propulsion level. Values sent to the propulsion level include: 1) specific impulse, 2) degraded 
status, 3) downthrust factor, and 4) cutoff factor. The engine diagnostic function also sends 
estimated thrust and mixture ratio to the propulsion level where they are used to verify that 
commands are implemented 

Specific impulse is estimated using the thrust estimate and the measured propellent flowrates. 
This parameter provides an indication of how efficiently the engine is operating. 

The degraded status indicates that the engine is no longer capable of full thrust and mixture 
ratio throttling. For example, if the FPOV fails, the engine can still maintain closed loop 
control over the thrust and mixture ratio with the OPOV and the OPFV but can not implement 
"large" changes in either variable. This parameter is a pass/fail type status and alerts the thrust 
vector and mixture ratio coordinators that the engine commands should not be changed. 

The downthrust factor is a measure that reflects the expected benefit of reducing thrust. 
Primarily, downthrusting relieves strain on the high pressure turbopumps. Therefore, this 
factor is defined by measurements indicative of excessive turbopump strain, in other words: 
speed, torque, turbine temperature, and vibra tion. These measurements are evaluated for both 
high pressure turbopumps (HPOTP and HPFTP) and are related to the benefit realized by 
downthrusting the engine. The overall benefits of incorporating the downthrust factor in the 
RREICS framework include degraded engine accommodation, risk minimization, and life 
extension issues. 

The cutoff factor is a measure that reflects the risk associated with continued engine operation. 
Other studies [Re: Health Management System For Rocket Engines, NASA-LeRC] have 
shown that engine failures are often indicated well before the failure occurs by changes in key 
engine parameters. The weighted sum of these changes generally increases as the degradation 
(impending failure) progresses and propagates through the system. It is expected that these 
values can be roughly correlated to the relative "risk" of engine failure and therefore provide a 
good source of information for an intelligent system to make engine cutoff decisions. 

Valve Sequence Coordinator (Figure 3-13) 

The valve sequence coordinator is responsible for safely starting and stopping the engine. 
When a start command is received from the propulsion level, actuator commands are issued in 
a preset sequence designed to minimize adverse affects associated with the start transient (e.g. 
the CCV is throttled down during early stages of the start sequence to provide additional 
cooling to the MCC). During mainstage, the valve sequence coordinator prepares for cutoff by 
updating the scheduled cutoff sequence in response to actuator failures. For example, if the 
FPOV fails (and is therefore locked in its current position) the actuator commands are 
resequenced to minimize the risk of catastrophic failure at cutoff. Initially, an alternate cutoff is 
selected from a set of predetermined sequences to ensure a timely response. Then this 
sequence is optimized to determine if a "better" sequence can be identified and validated (using 
a system model). The new sequence replaces the predetermined one. Therefore, upon receipt 
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of a cutoff command, the "best” cutoff sequence is issued for the current engine status. 
Actuators continue to be monitored during the cutoff and the sequence is altered, according to 
predetermined rules, in response to actuator failures. 

3.2 Conclusions About the Baseline Functional Framework 

The ICS baseline functional framework (BFF) identifies control capabilities that result in 
increased engine reliability, increased engine performance, and greater engine life by adapting 
the engine control in response to measured conditions. However, several significant 
limitations exist in the BFF. They are: 1) optimization of thrust, mixture ratio, and health 
parameters at the engine level is limited by using only the OPOV, FPOV, and OPFV to 
implement thrust and mixture ratio control, 2) life extension and performance optimization are 
implemented independently of the primary control objectives (thrust and MR) and have only a 
relatively minor impact on the engine, 3) feedback to the propulsion level is limited to 
calculated parameters (e.g. the downthrust factor) that describe the global engine condition but 
hide detailed engine information from the propulsion level. The BFF limitations result from 
the inability to process and evaluate large amounts of engine data in real time and the lack of 
detailed diagnostic and prognostic engine health algorithms. For the advanced functional 
framework described in Section 5.0, the data processing and engine health algorithm 
limitations are assumed to no longer exist. 
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Figure 3-1 a ICS Baseline Functional Framework - Rev. 2.3 
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Figure 3-5 Propulsion Diagnostics and Status 
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SECTION 4 DIAGNOSTIC SUBSYSTEM DEFINITION 

This section further defines the diagnostics function to include a description of the failure 
modes to be covered by the diagnostic system. The informational architecture, including 
required sensed information and engine status output information (failure severity, failure 
likelihood, etc.) is described.The rationale for failure mode selection is outlined below. 

4.1 Failure Mode Database 

Failure modes to be covered by the diagnostics system have been taken from the SSME 
FMEA-CIL documents, RSS-8553-11 and RSS-8740-11, dated 15 July 1988. The SSME 
FMEA was accomplished using a component functional analysis approach to identify the 
potential failure modes. The failure modes were then evaluated to determine the worst-case 
effect on engine, vehicle, crew and mission. The criticality code is determined by the worst- 
case effects statement. The current (for this referenced document) SSME flight and software 
configuration were analyzed. The depth of analysis is down to Line Replaceable Unit 
(LRU)/black box to identify all credible failure modes for that component. Failure mode 
causes were identified by the FMEA to the piece-part level for critical failures. Criticality 1R 
items were also analyzed to the lowest level necessary to verify that redundancy exists. Failure 
likelihood for each mode is not available from the FMEA as a statistical quantity. The OIL 
quotes number of seconds of operation for fleet leaders for various components including the 
number of failure free starts. 


The FMEA consists of the following volumes: 


Volume I 
Volume II 
Volume ID 
Volume IV 
Volume V 
Volume VI 
Volume VTI 
Volume Vm 
Volume IX 
Volume X 
Volume XI 
Volume XII 


Executive Summary 

Combustion Devices 

Fuel Turbopumps 

Oxidizer Turbopumps 

Pneumatic Controls 

Propellant Valves 

Actuators 

Controller 

Harnesses 

Igniters and Sensors 

Lines, Ducts, Joints and Orifices 

Flight Accelerometer Safety Cutoff System (FASCOS) 


4.2 Selection of failure modes 

Several cycles of screening have been used to extract candidate modes from the documentation 

as follows: . 

A pre limin ary list of failure modes was extracted from the data base of greater than 400 items. 
Emphasis was placed on modes amenable to corrective or mitigating action. Specific types of 
failure modes excluded for the diagnostics system were: 

• Failures occurring in too short a time to take corrective action 

• Failures where no corrective action is possible 

• Failures leading to unconditional engine cutoff. 
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This list of about 120 items was then reviewed in more detail for consideration of the various 
phases of the launch and ascent profile to generate failure accommodation tables (as described 
below). Some deletions were made, and the list was reduced to about 100 items. 

Some failure modes where no corrective action can presently be taken will still be considered 
where it may be possible to use new or additional sensors or where the candidate ICS valves 
may be used for corrective action. Exceptions to other criteria will always be made when there 
is some way the ICS may be used to accommodate, correct, or lessen the effect of a failure. 

Additional modes that could apply to generic engine diagnostics may be added. 

4.3 Failure Accommodation Tables 

The phases of operation covered are indicated in the failure accommodation tables. These are 
the same as indicated in the FMEA. An example is 0 = SMC. The five possible letters are 
defined as follows: 

Propellant Conditioning Phase (P) - Start of Purge Sequence 1 
through Purge Sequence 4, ending with Start Command. 

Start Phase (S) - Start Command to SRB Ignition (~ 5 seconds). 

Mainstage Phase (M) - Starts at SRB Ignition and ends with Cutoff 
Command at end of ascent phase. 

Cutoff Phase (C) - Starts at MECO Command and ends with Zero 
Thrust (includes on-pad cutoff following an aborted start and 
any unique failure effect). 

Dump (Post-Cutoff) Phase (D) - Begins with Zero Thrust and ends 
with completion of propellant dump including vacuum inerting. 

Item numbers for the various components are the FMEA item numbers, which in most cases 
are the same as the CEL reference numbers. Criticality codes (Crit = ) are included in the tables 
for quick reference and the timing (t = ) is noted where: 

I = Immediate -- less than one second 
S = Seconds — 1 to 60 seconds 
M = Minutes — 60 seconds to 60 minutes 
N/A = No set timing (damage may occur during cutoff) - 
Igniters and sensors generally have this timing 

Notes concerning failure mode history included in the CIL may also be found in the Failure 
Accommodation Tables. Tables for the volumes covered are found in Tables 4-1 through 4-6. 

4.4 Excluded Volumes 

The following volumes of the SSME FMEA were not included as ICS diagnostic candidates 
for the reasons listed: 

Actuators - Volume VII 

None of the actuator failure modes in the FMEA appear to be amenable to 
accommodation or resolution by the diagnostic system functions. Most failures result 
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in hydraulic or pneumatic lockup through redundancy and fail-safe mechanisms that are 
built into the actuators. 

Controller - Volume Vm 

The FMEA for the Controller will not be used because it is specific to the Block I 
Controller for the SSME. The design of the ICS has not yet been accomplished and 
may have significantly different architecture, packaging scheme and unique set of 
failure modes. 

Ducts/Lines, Joints and Orifices — Volume XI 

Failure modes associated with ducts/lines, joints and orifices will not be 
accommodated by the diagnostic system directly. Large failures in these 
components will, in general, lead very quickly to catastrophic engine failure. 

Minor leaks that do not lead to fire/explosion or overpressurization of the aft 
compartment may be covered indirectly by pressure or flow anomalies detected by 
various sensors. If optical or other leak detection systems are employed in the future, 
their measurement data would be analyzed by the diagnostic system. 

FASCOS - Volume XH 

The Flight Accelerometer Safety Cutoff System (FASCOS) is an integral part of the 
SSME Controller. It interfaces directly to the address and data bus of the controller. 

ICS designs may or may not use this approach. Future turbopump designs may 
incorporate bearing wear detection sensors capable of detecting/predicting bearing 
failure modes (a major source of excessive vibration) much earlier and more definitively 
than the present FASCOS. Thus, the way accelerometers are used may change 
significantly. Severe vibration indicates that enough mechanical damage has already 
occurred to make shutdown imperative. 

4.5 Failure Accommodation Discussion 

4.5.1 Combustion Devices 

The main failure modes in this category involve the blockage of a fuel, oxidizer, or hot gas 
flow. The failure of Augmented Spark Igniters (ASI) is also included. The failure of the ASIs 
is not very likely. The Main Injector Fleet Leader has accumulated over 19,000 seconds and 
60 starts without any anomalies (as of July, 1988). One in-flight failure occurred in 1984, 
when a drill chip lodged in an Oxidizer Prebumer fuel line (Item # A700-2). ASI chamber 
erosion was discovered during post flight inspection, but no engine failure occurred because 
the erosion was limited in scope. 

No corrective action appears possible for the ICS other than engine shutdown if erosion is 
present. There is no present or planned method for quantifying erosion. If erosion were 
detected late in the ascent profile, downthrusting or increasing the coolant flow might be an 
option for propulsion or mission level decision. Early detection by plume spectrometry would 
help ensure shutdown before severe erosion caused major structural failures. 

4.5.2 Fuel Turbopumps 

The failure accommodation tables show that the method of detection and control system action 
are very nearly the same for many of the failure modes. This is because of the method of 
control used for the staged combustion cycle type of engine with variable thrust. Fuel pump 
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output flow and pressure must be maintained to ensure proper mixture ratio and cooling. Any 
anomaly that reduces output causes an increase in oxidizer to the fuel turbopump prebumer to 
increase turbine power. If the anomaly is a developing failure mode, pump output may 
continue to decrease, and oxidizer input to the fuel prebumer will be increased further. This 
can escalate rapidly, and rising turbine discharge temperature may exacerbate the problem, 
causing the failure mode to develop even more quickly. Rates at which the OPFV is modulated 
to control mixture ratio during anomalous operation, however detected, should be carefully 
monitored. 

Correlation of rising turbine discharge temperature on the HPFTP with other measurement 
parameters should be made wherever possible to determine the specific failure mode. 
Degraded status and updated downthrust factor must be relayed to the propulsion level of the 
functional framework as quickly as possible to insure that potential engine cut-off actions are 
timely while still being based on overall mission objectives. Additional sensors such as 
bearing wear detectors and plume spectrometers that may give advance warning of turbopump 
failures are highly recommended. 

4.5.3 Oxidizer Turbopumps 

As with the fuel turbopumps, the failure accommodation tables show that the method of 
detection and control system action are very nearly the same for many of the failure modes. 
Oxidizer pump output flow and pressure must be maintained to ensure that the proper thrust 
levels for the mission profile are satisfied. Any anomaly that reduces output (as determined by 
thrust calculations) causes an increase in oxidizer to the oxidizer turbopump prebumer to 
increase turbine power. A developing failure mode may cause output to continue to decrease, 
and oxidizer input to the oxidizer prebumer will be increased further by opening the OPOV. 
Rapid escalation of failure modes is also possible (and likely) in the HPOTP. 

Again, the earliest possible detection of a failure mode is very important 
and newer sensors and diagnostic methods should be employed. 

4.5.4 Pneumatic Controls 

This group of components has a very good history of reliability. Purge check valves are 
simple in design compared with propellant valves and generally operate under less severe 
conditions (no cryogenic fluid flow through the valve). Other components are somewhat more 
complex, but they have been carefully designed and evolved through extensive testing. The 
components are active mainly during Prestart, Start and Cutoff. 

Only limited time for analysis/accommodation is available during Start and Cutoff. One 
exception is the HPOTP Intermediate Seal Purge PAV that is very important during Mainstage 
to maintain separation of LOX and fuel rich hot gas in the pump turbine. This seal purge 
pressure is monitored by a pressure transducer whereas some other purge pressures are not 
directly monitored. In general, this group may be of limited interest to the ICS except for 
engine status. 

4.5.5 Propellent Valves 

The valves selected as candidates for ICS have demonstrated good reliability for the failure 
modes described. The main propellant valves were not selected because they are moved on a 
predefined schedule to either fully open or fully closed positions, and are not used for thrust or 
mixture ratio control. Opening rates and relative timing affect Start and Cutoff transients. 
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Control is effected through the two valves (FPOV and OPOV) that control the flow of oxidizer 
to the prebumers, and the Chamber Coolant Valve (CCV) is scheduled linearly with thrust 
reference such that it will be partially open at minimum power level (65%) and fully open at the 
100% thrust level. Heat transfer loads on the MCC and Nozzle do not decrease at a rate that 
matches the decrease in total hydrogen flow when thrust is decreased. Therefore, the 
CCV, which acts as a bypass valve, must be partially closed to force more of the available 
hydrogen flow through these components at the lower thrust levels. 

The prebumer oxidizer valves may be opened or closed when the controller attempts to 
compensate for other failure modes (such as loss of impeller head rise in the HPFTP). This 
may cause turbine discharge temperature to exceed redline limits. The bleed valves are not 
operated by servoactuators, but they do have position feedback. 

4.5.6 Igniters and Sensors 

This group of components should receive close attention in considering failure mode candidates 
for the ICS. The use of analytical redundancy should be considered wherever it is possible to 
compensate for sensor failures. At present, temperature and pressure sensors are dual channel 
devices, and critical measurements, e.g., MCC pressure, have redundant sensors. 

The more important sensors may be categorized into three groups as defined in the following 
tables. Thus, some measurements are more important during one phase of the mission than 
another. HPFTP shaft speed, for example, is of secondary interest during Mainstage and 
Cutoff. 


Engine Ready Sensors: 

a. LPFTP Discharge Pressure 

b . LPFIP Discharge Temperature 

c . Prebumer Pump Discharge Temperature 

d. LPOTP Discharge Pressure 

Performance Control Sensors: 

a. MCC Pressure 

b . L PFTP Discharge Pressure 

c . LPFIP Discharge Temperature 

d. Fuel Flowrate 

Engine Limit Control Sensors: 

a. HPFTP Turbine Discharge Temperature 

b . HPOTP Intermediate Seal Purge Pressure 

c. HPOTP Secondaiy Seal Cavity Pressure 

d . HPOTP Turbine Discharge Temperature 

e. Prebumer Shutdown Purge Pressure 


e. Emergency Shutdown Pressure 

f . Prebumer Purge Pressures 

g . MOV Hydraulic Temperature 

h . MFV Hydraulic Temperature 


f . HPFTP Coolant Liner Pressure 

g. Ignition Confirm, MCC Pressure 

h . Ignition Confirm, Antiflood Valve 

i. Ignition Confirm, HPFTP Speed 


Sensors not in these groups may be considered as flight data sensors only. 


4.6 Informational Architecture 

Block diagrams illustrating a proposed "informational architecture" have been prepared for 
each of the FMEA volumes used for the data base. The diagrams may be found in Figure 4-1 
through Figure 4-6. Intermediate actions that may be taken to accommodate or lessen the effect 
of incipient failures, before a decision to cutoff, are shown for groups of failure modes that 


RI/RD91-158 


PAGE 15 



cause similar symptoms (e.g., increase in turbine discharge temperature). The three main 
actions identified are: downthrust, decrease O/F, and increase coolant flow. 

4.7 Diagnostic Subsystem Conclusions 

The majority of FMEA criticality 1 failures for the SSME eventually lead to an engine 
shutdown. However, the useful life of an engine can be extended by downthrusting the 
engine if the failure is detected in the early stages. For combustion device failures, minor 
improvements in the engine life can be made by changing the engine mixture ratio and by 
redistributing available coolant through the affected area of the engine. 
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Table 4-1 FMEA Summary - Combustion Devices 


Failure 

Description 

Detected by 

Control System Action 

A050-1 
0 = SMC 

Powerhead - 
Liner failure 

Crit = 1 
t = S 

Rapid rise of turbopump 
discharge temps 

If not severe, may be able to downthrust or decrease O/F to 
increase cooling. No failure history. 

A200-1 
0 = S 

Main Injector - 
ASI falls to ignite 

Crlt = 1 R 
t s S 

MCC pressure low 

Engine shutdown during start phase -quick detection will 
minimize potential engine damage. No failure history 

A200-2 
0 = SMC 

Main Injector — 
Loss of fuel to ASI 

Crit = 1 
t = S 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before high mixture ratio 
erosion leads to injector burnout. No faiiure history. 

A200-3 
0 = SMC 

Main Injector -- Crlt = 1 t = S 

Blockage of one LOX ASI passage 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before erosion leads to 
injector burnout. No failure history. 

A200-5 
0 = SMC 

Main Injector - Crit = 1 t = S 

Partial blockage of an oxidizer orifice 

Erosion may be detected 
by plume spectrometry 

f detectable, engine shutdown before erosion leads to injector 
turnout. Two cases (1979 ) - no effect during hotfire. 

A330-5 
0 = M 

MCC 

Lee Jet is blocked 

Crit = 1 R 
t = S 

MCC pressure sensor 
qualification limit exceeded 

Disqualify sensor — may choose not to allow electrical 
lockup if other MCC pressure sensor fails. No failure history. 

A340-1 
0 = M 

Nozzle Assembly ~ Crlt = 1 R t = S 

Multiple internal tube fuel leakage 

Turbine discharge temps 
increase 

Engine shutdown. If redlines not exceeded, try to adjust the 
mixture ratio by modulation of the FPOV. Two cases (1979) 

A600-1 
0 = S 

Fuel Preburner -- 
ASI fails to ignite 

Crit = 1 R 
t = S 

HPOTP speed will not 
reach lower limit 

Engine shutdown - redline on lower limit of HPFTP 
speed during Start. No failure history. 

A600-2 
0 = SMC 

Fuel Preburner - 
Loss of fuel to ASI 

Crit = 1 
t = S 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before high mixture ratio 
erosion leads to Injector burnout. No failure history. 

A600-3 
0 = SMC 

Fuel Preburner -- Crit = 1 t = S 

Blockage of one LOX ASI passage 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before erosion leads to 
injector burnout. No failure history. 

A700 
0 = S 

Oxidizer Preburner - 
ASI falls to ignite 

- — -i 

Crlt = 3 
t = S 

Turbine discharge temp 
below lower limit 

Engine shutdown - redline on lower limit of HPOTP turbine 
discharge temp. No failure history. 

A700-2 
0 = SMC 

Oxidizer Preburner - 
Loss of fuel to ASI 

Crlt = 1 
t = S 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before high mixture ratio 
erosion leads to injector burnout. One failure (1984) 

A700-3 
0 = SMC 

Oxidizer Preburner -- Crit = 1 t = S 

Blockage of one LOX ASI passage 

Erosion may be detected 
by plume spectrometry 

If detectable, engine shutdown before erosion leads to 
injector burnout. No failure history. 
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Failure 

Table 4-2 FMEA 

Description 

k Summary - Fuel 

Detected by 

TurboPumps (1 of 3) 

Control System Action 

B200-1 
0 = SM 

High Pressure Fuel TP - Grit = 1 R 
Leakage past preburner G5 seal into 
the HGM 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B200-2 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Energy loss at turbine inlet 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B200-5 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Rotor tip seal leakage 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B200-6 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Platform seal leakage 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B200-9 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Pressure drop or flow distortion at 
Impeller inlet 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B200-10 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Loss of Impeller head rise 

t K 1 

HPFTP turbine discharge 
temp increase toward 
redline limit and vibration 
may increase 

Initially, a decrease in turbine output causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. Early test failure (1984). 

B200-11 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 

Excessive Impeller bypass leakage 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 
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Table 4-2 FMEA Summary - Fuel TurboPumps (2 of 3) 


Failure 

Description 

Detected by 

Control System Action 

B200-12 
0 = SM 

High Pressure Fuel TP - Crit s 1 R 
Excessive pump interstage 
seal leakage 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase In 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shut down. No failure history. 

B200-13 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Energy loss in diffusers and 
housing 

t = l 

HPFTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shut down. No failure history. 

B200-15 
0 = SMC 

High Pressure Fuel TP - Crit = 1 
Loss of support or 
position control 

t = 1 

Pump speed decrease and 
increased level of vibration. 

May use spectrometry to 
detect bearing wear 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible If turbopump fails quickly. 
Two isolated failures (1985, 1983 ). 

B200-16 
0= SMC 

High Pressure Fuel TP - Crit = 1 
Loss of coolant flow to 
turbine bearings 

t = l 

Excessive wear of races 
or bearings may be 
detected by plume spec- 
trometry 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible if turbopump fails quickly. 
No failure history. 

B200-17 
0 = SM 

High Pressure Fuel TP - Crit = 1 
Loss of coolant flow to t _ j 

turbine discs 

None at present 

TBD 

No failure history. 

B 200-20 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Excessive coolant flow ^ _ j 

Rise in coolant liner 
pressure 

Engine shutdown if coolant liner pressure exceeds the 
redline limit. One failure -coolant liner buckle. 
Leakaqe at lift-off seal caused overpressurization. 

B 200-21 
0 = SM 

High Pressure Fuel TP - Crit = 1 R 
Excessive hot gas leakage 
into coolant circuit t = I 

Rise in coolant liner 
pressure 

Engine shutdown if coolant liner pressure exceeds the 
redline limit. 

No failure history. 

B200-24 
0 = S 

High Pressure Fuel TP - Crit = 1 R 
Shaft movement not restrained during 
Start (shaft speeds below 12,000 rpm) 

t = S 

Fast rise in turbine 
discharge temp. 

Rubbing or wearing may 
be detected by plume 
spectrometry. 

Engine shutdown if turbine discharge temp exceeds the 
redline limit. 

No failure history. 
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Table 4-2 FMEA Summary - Fuel TurboPumps (3 of 3) 


Failure 

Description 

Detected by 

Control System Action 

B600-1 
0 = SM 

Low Pressure Fuel TP - Crit = 1 R 
Energy loss at turbine inlet 

t = l 

Rise in HPFTP turbine 
discharge temp 
Low shaft speed 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B600-2 
0 = SM 

Low Pressure Fuel TP - Crit = 1 R 

Power loss in rotor 

t = l 

Rise in HPFTP turbine 
discharge temp 
Low shaft speed 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B600-4 
0 = SM 

Low Pressure Fuel TP - Crit = 1 R 
Loss of head rise 

t = l 

Rise in HPFTP turbine 
discharge temp 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B600-5 
0 = SM 

Low Pressure Fuel TP - Crit = 1 R 
Loss of support or position control 

t = l 

Pump speed decrease and 
increased level of vibration. 

May use spectrometry to 
detect bearing wear 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible if turbopump fails quickly. 
No failure history. 

B600-8 
0 = SM 

Low Pressure Fuel TP - Crit = 1 R 

Turbine seal leakage 

t = S 

Cavitation, if present, will 
cause increase in HPFTP 
turbine discharge temp 

Engine shutdown if turbine discharge temp increases to 
redline limit. May shut down before limit if high vibration is 
also present. No failure history. 
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Table 4-3 FMEA Summary - Oxidizer TurboPumps (1 of 3) 


Failure 

Description 

Detected by 

Control System Action 

B400-1 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 
Leakage past outboard 
OPB/HPOTP seal t = 1 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B400-2 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 
Energy loss at turbine 
inlet due to excessive flow 
distortion t = i 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B400-4 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 

Turbine blade tip seal 

leakage 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. One test failure (1985). 

B400-5 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 

Turbine interstage seal 

leakage 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B400-6 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 
Turbine discharge flow 
blockage 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B400-8 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 

Flow distortion at main 

pump inlet t = 1 

HPOTP turbine discharge 
temp increase toward 
redline limit and vibratoion 
may increase 

Initially, a decrease in turbine output causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B400-9 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 

Loss of Inducer/Impeller 

head rise t = 1 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 
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Table 4-3 FMEA Summary - Oxidizer TurboPumps (2 of 3) 


Failure 

Description 

Detected by 

Control System Action 

B400-10 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 
Energy loss at main pump 
difuser \ - 1 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but . 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shut down. No failure history. 

B400-11 
0 = SM 

High Pressure Oxid. TP - Crit = 1 R 
Inadequate preburner 
pump impeller head rise 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shut down. No failure history. 

B400-13 
0 s SMC 

High Pressure Fuel TP - Crit = 1 

Loss of support or 

position control t = 1 

Pump speed decrease and 
increased level of vibration. 

May use spectrometry to 
detect bearing wear 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible if turbopump fails quickly. 
Four failures during engine test 

B400-1 5 
0 = SMC 

High Pressure Oxid. TP - Crit = 1 
Loss of purge pressure t __ | 

barrier 

None at present 

TBD 

No failure history 

B400-18 
0 = SM 

High Pressure Oxid. TP - Crit = 1 
Loss of coolant flow to 
bearings \ _ s 

None at present 
Excessive wear of races 
or bearings may be 
detected by plume spec- 
trometry 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible if turbopump fails quickly. 
No failure history. 

B400-19 
0 a SM 

High Pressure Oxid. TP - Crit = 1 R 

Loss of coolant fiow to 

turbine seals _ g 

Turbine secondary seal 
cavity pressure meas. 
Metallurgical deterioration 
may be detected by plume 
spectrometer 

Engine shutdown if redline is exceeded. 

If correlated with plume measurements, shutdown with more 
safety margin may be possible. 

No failure history. 

B400-20 
0 = SMC 

High Pressure Oxid. TP Crit = 1 

Coolant loss to 1st and 2nd 
stage turbine components 

t = S 

None at present 
Metallurgical deteriorization 
may be detected by plume 
spectrometer 

TBD 

Early failures found only on disassembly and the causes 
corrected (1985, 1983, 1982 ) 
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Table 4-3 FMEA Summary -Oxidizer TurboPumps (3 of 3) 


Failure 

Description 

Detected by 

Control System Action 

B800-1 
0 = SM 

Low Pressure Oxid. TP - Crit = 1 R 
Seal leakage at turbine inlet 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B800-2 
0 = SM 

Low Pressure Oxid. TP - Crit = 1 R 
Loss of turbine power 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. One test failure (1984). 

B800-4 
0 = SM 

Low Pressure Oxid. TP - Crit = 1 R 
Loss of Inducer head rise 

t = l 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B800-5 
0 = SM 

Low Pressure Oxid. TP - Crit = 1 R 
Loss of dynamic head 
recovery/guidance t = 1 

HPOTP turbine discharge 
temp increase toward 
redline limit and pump 
speed decreases 

Initially, a decrease in turbine power causes an increase in 
preburner oxidizer to maintain pump flow and pressure, but 
this may increase turbine discharge temp beyond the redline 
limit and engine must be shutdown. No failure history. 

B800-6 
0= SMC 

Low Pressure Oxid. TP - Crit = 1 
Loss of support and 
position control 

t = l 

Pump speed decrease and 
increased level of vibration. 
May use spectrometry to 
detect bearing wear 

Early detection of this mode by plume spectrometry or other 
means is imperative to prevent vehicle loss by engine 
shutdown. No action is possible if turbopump fails quickly. 
One case of excessive vibration observed — no attributable 
cause found during extensive inspections (1985 ) 
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Table 4-4 FMEA Summary - Pneumatic Controls (1 of 2) 


Failure 

Description 

Detected by 

Control System Action 

cm 

0 = S 

FPB Purge Check Valve - Crit = 3 
Check valve leaks 

t s N/A 

Fuel and oxidizer 
preburner shutdown 
purge pressure 

Controller monitors pressure from Start to Start +2.3 seconds. 
If redline limt is exceeded, engine Is shutdown. 

No failure history. 

C112 
0 = S 

OPB Purge Check Valve - Crit = 3 
Check valve leaks 

t s N/A 

Fuel and oxidizer 
preburner shutdown 
purge pressure 

Controller monitors pressure from Start to Start +2.3 seconds. 
If redline limt is exceeded, engine is shutdown. 

No failure history. 

Cl 13-1 
0 = PS 

Oxidizer Dome Purge Crit = 1 

Check Valve - * :s s 

Fails to open or restricts flow 

None at present 

TBD 

No failure history. 

Cl 14 
0 = PS 

Fuel Purge Check Valve - Crit = 3 
Fails to open or restricts 
flowKT = 1 t = 1 

HPOTP or HPFTP turbine 
discharge temperature 

Engine shutdown if redline exceeded. 
No failure history. 

Cl 16-1 
0 = PSC 

FPB ASI Purge Check Crit = 1 , 3 

Valve -- * = s 

Fails to open or restricts flow 

None at present 

TBD 

No failure history 

Cl 17-2 
0 = S 

OPB ASI Purge Check Crit = 3 

Valve - t _ j 

Check valve leaks 

Fuel and oxidizer 
preburner shutdown 
purge pressure 

Controller monitors pressure from Start to Start +2.3 seconds. 
If redline limt is exceeded, engine is shutdown. 

No failure history. 

C200-7 
0 = PS 

PCA oxidizer system Crit = 1 

purge -- 

Insufficient or no N 2 purge flow 
during conditioning t = M 

None at present 

TBD 

Two failures: 1982, contamination; 1984, failed poppet 

C200-8 
0 = PSMC 

PCA HPOTP Intermediate Crit = 1 
Seal Purge -- 

Insufficient or no He purge flow 

t = 1 

HPOTP intermediate seal 
pressure 

Controller monitors intermediate seal pressure for out of limit 
condition. Start inhibit during Phase P. Engine shutdown 
during SMC (redline). 

No failure history. 
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Table 4-4 FMEA Summary - Pneumatic Controls (2 of 2) 


Failure 

Description 

Detected by 

Control System Action 

C200-1 1 
0 = S 

PCA Emergency Crit = 1 

Pneumatic Shutdown - 
Failure to supply helium 
pressurant t = 1 

None at present 

TBD 

One failure on vehicle prelaunch test, 1984, contamination 

C200-16 
0 = SMC 

PCA - Crit = 1 

Fails to contain helium 

t = l 

HPOTP intermediate seal 
pressure 

Controller monitors intermediate seal pressure for out of limit 
condition. Start inhibit during Phase P. Engine shutdown 
during SMC (rediine). 

No failure history. 

C300-1 
0 = PSC 

Helium Prechargs Valve - Crit = 3,1 
Insufficient or no He flow 
to Pogo Accumulator t _ | 

Pogo precharge pressure 

Inhibit Start in Phase P 

Engine shutdown in Phase S 

TBD in Phase C - cavitation/overspeed of oxidizer 

turbopumps possible at zero G and minimum NPSP. 

No failure history. 

C300-7 
0 = PSMC 

Helium Precharge Valve - Crit = 1 
Fails to contain oxidizer 

t = l 

None at present 

TBD 

No failure history. 
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Failure 

Table 4-5 FMEA 

Description 

Summary - Prope 

Detected by 

client Valves 

Control System Action 

D130-2 
0 = SM 

Fuel Preburner Oxidizer Crit = 1 R 
Valve - 

Fails to move or moves slowly. 

No SEII. 

t = s 

HPFTP or HPOTP turbine 
discharge temperature 

Engine cutoff if redline is exceeded. 
See Note below: 

No Failure history. 

D140-2 
0 = SM 

Oxidizer Preburner Crit = 1 R 

Oxidizer Valve - 

Fails to move or moves slowly. 

No SEII. 

tsS 

HPFTP or HPOTP turbine 
discharge temperature 

Engine cutoff if redline is exceeded. 
See Note below: 

No Failure history. 

D150-1 
0 = SM 

Coolant Control Valve — Crit s 1 R 

Fails to move or moves slowly. t _ \ 
No SEII. 

HPFTP Or HPOTP turbine 
discharge temperature 

Engine cutoff if redline is exceeded. 
See Note below: 

No Failure history. 

D210-4 
0 = P 

Fuel Bleed Valve - Crit = 1 R 

Erroneous position feedback. 

t = l 

None at present 

TBD 

One failure, 1983 ~ manufacturing procedure changed. 

D220-4 
0 = P 

Oxidizer Bleed Valve - Crit = 1 R 

Erroneous position feedback. 

t = l 

None at present 

TBD 

No failure history. 

Fleet leader has over 26,450 seconds hot fire time. 




Note: One servoactuator failure is permitted with no change 
in performance. Switching to redundant backup is automatic. 
Continued presence of SEII initiates various shutdown 
scenarios. When no SEII is present, turbine discharge 
temperatures are the failure indication parameters. 

SEN = Servoacutator Error Indication Interrupt 
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Failure 

J201-1 
& J202-1 
0= M 


Table 4-6 FMEA Summary - Igniters and Sensors (1 of 5) 

Description I Detected by I Control System Action 


MCC Pressure 
Transducer 


Crit = 1R 


All sensors drift in the same direction 


HPFTP or HPOTP turbine 
discharge temperatures 
and OPOV command limit 


Present action is shutdown if temps or command limit 
exceeded. It may be possible to synthesize Pq based on 
other measurements and compare to detect erroneous drift. 
Three failures: 

1977; port plugged with ice - added Lee Jet purge 
1985; erroneous output, broken lead wire - new process 
1987; zero shift due to link pin weld - new weld controls 


LPOTP Discharge Grit = 3 

Pressure Transducer- ^ /A 

No output or erroneous output 

FPB Chamber Crit = 3 

Pressure Transducer - t _ N/A 

No output or erroneous output 

Oxidizer Tank Crit = 3 

Pressurant T ransducer - t _ N/A 


No output or erroneous output 


HPFTP Discharge 
Pressure Transducer 


Crit = 3 
t a N/A 


No output of erroneous output 

HPOTP Boost Pump Crit = 3 

Pressure T ransducer - t = N/A 

No output of erroneous output 

Fuel Injection Crit = 3 

Pressure T ransducer - t _ N/A 


None at present for 
erroneous output 


None at present for 
erroneous output 


None at present for 
erroneous output 


None at present for 
erroneous output 


None at present for 
erroneous output 


None at present for 
erroneous output 


No output of erroneous output 


No action required at present. 

Loss of data only 
No failure history. 

No action required at present. 

Loss of data only 
No failure history. 

No action required at present. 

Loss of data only 
No failure history. 

No action required at present. 

Loss of data only 
No failure history. 

No action required at present. 

Loss of data only 
No failure history. 

No action required at present. 

Loss of data only 
No failure history. 
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Failure 

Table 4-6 FMEA 

Description 

Summary - Ignite 

Detected by 

rs and Sensors (4 of 5) 

Control System Action 

J306-1 
0 = SM 

LPFTP Discharge Crit = 3,1 R 

Temperature Transducer - 

t = S 

Erroneous output 

LPFTP Discharge 
temperature qualification 
limits. 

Failure of one channel during Start phase causes controller to 
post MCF and the vehicle will command shutdown. 

During mainstage, both channels bad deletes redline. 

Two failures,1982; intermittent signal - wet connector 

J309 

0 = SMCD 

MCC Coolant Outlet Crit = 3 

Temperature Transducer ~ 

t = N/A 

Erroneous output 

None at present for 
erroneous output. 

No action required at present 

Loss of data only. 

No failure history. 

J310 

0 = SMCD 

MOV Hydraulic Crit = 3 

Temperature Transducer - 

t = N/A 

Erroneous output 

None at present for 
erroneous output. 

No action required at present 

Loss of data only. 

No failure history. 

J311 

0 = SMCD 

MFV Hydraulic Crit s 3 

Temperature Transducer - 

t = N/A 

Erroneous output 

None at present for 
erroneous output. 

No action required at present 

Loss of data only. 

No failure history. 

J312 

0 = SMCD 

HPOTP Boost Stage Crit a 3 

Discharge 

Temperature Transducer - t = N/A 
Erroneous output 

None at present for 
erroneous output. 

No action required at present 

Loss of data only. 

No failure history. 

J313 
0 = SM 

MCC Oxidizer Injection Crit = 3 

Temperature Transducer - 

t = N/A 

Erroneous output 

None at present for 
erroneous output. 

No action required at present 

Loss of data only. 

No failure history. 

J350 
& J351 
& J352 
0 = P 

MFV/OPV/AFV Skin Crit = 3,1 R 

Temperature Transducers - 

t = S 

Erroneous output 

Skin temperature launch 
temperature commit criteria 
limits. 

No detection if within limits. 

Launch delay if out of limits 
TBD if within limits but erroneous. 

No failure history 
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Failure 

Table 4-6 

Description 

FMEAS 

iummary - Igniter 

Detected by 

s and Sensors (5 of 5) 

Control System Action 

J601-1 
& 602-1 
0 = M 

Fuel Flow Transducer - 
Intermittent or no output 

Crit = 1 R 
t = S 

Fuel Flowmeter 
qualification limits. 

Loss of one channel results in disqualification of that channel. 
Loss of both channels precludes mixture ratio control and 
the controller initiates electrical lockup. 

No failure history. 

J607 

0 = SMCD 

LPFTP Shaft Speed 
Transducer - 

Intermittent or no output 

Crit = 3 
t a N/A 

None at present 

No action required at present. 

Loss of data only. 

No failure history (no CIL entry). 

J608 

0 = SMCD 

HPFTP Shaft Speed 
Transducer - 

Intermittent or no output 

Crit = 3,1 R 
t = N/A 

HPFTP shaft speed 
ignition confirmed limit. 

Engine shutdown if no confirmation during Start phase. 

Loss of data only during MCD phases. 

One failure, 1985; bridge open - isolated failure. 

J609 

0 = SMCD 

LPOTP Shaft Speed 
Transducer - 

Intermittent or no output 

Crit = 3 
t s N/A 

None at present 

No action required at present. 

Loss of data only. 

No failure history. 

J701-1 
0 = SM 

Fuel Flowmeter - 

Erroneous flowmeter 
turbine speed 

Crit = 3,1 R 
t = S 

HPFTP or HPOTP turbine 
temperature redline 
limits. 

Engine shutdown if temperatures exceed redline limits. 
No failure history. 
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Exceptions: 

330-5 MCC Lee Jet blocked 
Detected by redundant sensors 




A200-1 
A200-2 
A200-3 
A600-1 

Failure 

A700 

Modes 





A200-5 
A600-2 
A600-3 
A700-2 


A700-3 

Failure 


Modes 



Failure 

Modes 

1 


A050-1 


Note: CCV full open except 
In 65% to 100% thrust 
range 


These arrows mean 


bypass accommodation 
H failure appears severe 


Figure 4-1 Combustion Devices 
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B 200-1 

B200-2 

B200-5 

B200-6 

B200-9 

B 200-10 

B200-11 

B200-12 


B200-13 



HPFTP 


Loss of flow 

/ 

modes 



B200-15 

B200-16 

HPFTP 

Loss of support 
modes 

1 





B200-17 
B 200-20 
B200-21 

HPFTP 

Seal failures in 
coolant circuits 

1 


These arrows mean 
bypass accommodation 
If failure appears severe 


Figure 4-2 Fuel Turbopumps 
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Prestart. Start. & Cutoff 


cm 

C112 
C114 
Cl 17-2 



Exceptions: No detection method 
at present 

Cl 13-1 
Cl 16-1 
C200-7 
C200-11 
C300-7 


Figure 4-4 
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Pneumatic Controls 
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Start & Mainstaae 


D210-4 

D220-4 



FBV or OBV 
Position Limits 
Exceeded 


\ 


( 


Inhibit Start 




* Note: SEII = Servoactuator Error Indication Interrupt — 
Interrupt persists if redundancy fails 



Figure 4-5 Propellant Valves 
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Failed Channels 
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Vehicle Commands 
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No Output 
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Failed 


Both Channels 
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Both Channels 
Failed 


These arrows mean 
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Figure 4-6 Igniters & Sensors 





SECTION 5 INVESTIGATION OF SSME START TRANSIENT CONTROL 


In the current SSME startup, open loop valve control, redline aborts, and closed loop valve 
control are used to safely start the engine. Initially, the engine is operated in an open loop 
mode with the valves responding to scheduled commands. Proportional and integral thrust 
control begins at 2.40 seconds. Proportional and Integral control of the mixture ratio is 
initiated at 3.6 seconds. 

The valve sequence was developed for a nominal SSME start. For each perturbation about the 
nominal engine parameters (e.g. nominal breakaway torques, nominal propellent pressures, 
etc.) a slightly different valve sequence would best ensure engine start and minimize damaging 
transient effects. To successfully start the SSME requires that engine characteristics are 
measured between each flight to ensure nominal values and that external conditions (e.g. 
propellent conditions) are tightly controlled. 

The SSME start sequence has been developed and refined to the point where the current start 
sequence represents a near optimal tradeoff between starting the engine and minimizing engine 
damaging transients. There is, therefore, little interest in exploring alternate startup techniques 
to improve the nominal startup characteristics. 

However, the sequence of engine phenomena (governed by the startup sequence) that 
successfully start the engine is highly sensitive to external conditions, such as propellent 
temperatures, and to internal engine characteristics, such as turbine breakaway torques. 
Relatively minor changes in propellent conditions or engine characteristics result in large 
transient events (e.g. temperature spikes) or can inhibit the successful start of an engine. The 
sensitivity of the engine startup to external conditions and engine characteristics is attributed to: 
1) the highly coupled and non-linear phenomena occuring during startup, and 2) the limited 
closed loop control of the engine during startup. In this task, the possibility of reducing 
engine startup sensitivities by using additional closed loop control during startup is 
investigated. The desired result of such a control strategy is a more robust and reliable engine 
system. 

The goal of this task is to explore the means by which closed loop control may be used to 
increase the SSME performance and safety during startup and to determine if such closed loop 
control is possible. The objectives of additional closed loop control during startup, as part of 
the Advanced Functional Framework, include: 

- desensitizing the system to engine parameter variations 

- desensitizing the system to external perturbations or noise 

- improving the system performance by: 

- expanding the performance envelope by stabilizing unstable engine modes 

- ensuring safe operation nearer the performance envelope boundary 

- increasing the engine reliability 

- reducing the SSME maintenance costs 

Additional closed loop SSME startup control would achieve these advantages by monitoring 
and controlling all parameters of the engine which are critical to the performance and health of 
the engine. The current state of the SSME is a function of the prior engine state and the fuel 
and oxidizer flow rates throughout the engine. Thus, the state of the engine is ultimately 
defined by the valves, the original engine state, and engine perturbations. Since the latter two 
contributors cannot be directly controlled without modifications to the engine, valve control is 
the object of this study. 
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This section includes: 1) a description of the current SSME startup sequence, constraints, and 
failure history, 2) an overview of the approaches investigated, 3) the conclusions of this 
investigation, and 4) recommendations for further study. 

5.1 The Current SSME Startup Sequence 

5.1.1 Nominal SSME Startup 

The current SSME start transient is controlled by opening the engine propellent valves in a 
predetermined sequence and providing limited closed loop control. This sequence was 
developed and optimized over the course of years with the aid of hundreds of hardware firings 
and thousands of simulations. A thorough description of the SSME startup valve commands 
and resulting engine responses are described by Bob Biggs, SSME Systems Analysis Project 
Engineer, in a paper presented to the American Astronautical Society in 1989 titled Space 
Shuttle Main Engine The First Ten Years. The SSME startup as described by Mr. Biggs is 
given in the next paragraphs. 

When a start command is received, the MFV is immediately ramped to its full open position in 
two-thirds of a second (see Figure 5-0). This enables the liquid hydrogen (LH2) to fill the 
downstream system and begin to power the high pressure turbines. The latent heat of the 
hardware imparts enough energy to the hydrogen to operate as an 'expander-cycle* engine for 
the early part of the start sequence. This eliminates the need for any auxiliary power to initiate 
the start sequence, however it also creates a thermodynamic instability which is referred to as 
the fuel system oscillations. When the cold LH2 begins to flow into the thrust chamber nozzle, 
the hardware latent heat causes the hydrogen to expand rapidly, creating a flow blockage and 
momentary flow reversal. The result is a pulsating fuel flow rate with an unstable pressure 
oscillation at a frequency of approximately 2 Hz. The oscillations continue to increase in 
magnitude with dips (reductions in pressure) occuring at approximately 0.25, 0.75, and 1.25 
seconds, until the establishment of MCC chamber pressure causes it to stabilize after 1.5 
seconds. Events prior to stabilization had to be made to conform to the idiosyncrasies of the 
fuel system oscillations. 

Simultaneously with the opening of the MFV, electrical power is provided to the spark plugs in 
the augmented spark igniters (ASI) included in each of the three combustors. The ASI will 
then ignite the combustors when both fuel and oxidizer are present in the proper mixture ratio. 
The fuel is provided first by the MFV being opened and then the oxidizer is provided later for 
each combustor separately through the three oxidizer valves. Each valve has an ASI liquid 
oxygen (LOX) supply line that allows LOX to flow to the ASI upon initial valve motion (about 
5 percent). The proper mixture ratio for ignition is achieved by the second dip in pressure 
caused by the fuel system oscillations. 

After the MFV starts to open, the three oxidizer valves are separately subjected to a series of 
position commands intended to precisely control the oxidizer system priming times for the three 
combustors. Priming is the process of filling the system with liquid, as with the old hand 
cranked water pump. An oxidizer system is said to be 'primed' when it is filled with liquid 
down to the combustor such that the flow rate entering the injector is equal to the flow rate 
leaving the injector to be burned in the combustor. This event generally results in a rapid rise 
in combustion chamber pressure. The target priming times for the three combustors are a tenth 
of a second apart; FPB prime at 1.4 seconds, MCC prime at 1.5 seconds, and OPB prime at 
1.6 seconds. Although part of the valve positioning is accomplished under a limited form of 
closed loop control, it is merely a convenient method of commanding the valves to a 
predetermined position and therefore will be treated as if it were all done an open loop 
commanded positions as a function of time. 
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The first oxidizer valve to be commanded is the FPOV. After a delay of 0.10 seconds, the 
FPOV is ramped to 56 percent open at its maximum slew rate. At 0.72 seconds, the FPOV is 
given a ’notch* command to close to about 10 percent and then reopen. This is done to 
compensate for the second pressure dip caused by the fuel system oscillations and avoid 
damaging temperature spikes in the HPFTP turbine. During th is dip , the FPB is ignited and 
and the additional power causes a slight acceleration in the HPFTP speed. Just prior to the 
third fuel system oscillation pressure dip, the FPOV is given another notch command which is 
maintained throughout the priming sequence. 

A safety check is made at 1.25 seconds to ensure that the HPFTP speed is high enough to 
safely proceed through the priming sequence. The speed must be high enough at MCC prime 
to be able to pump hydrogen through the downstream system against the backpressure rise 
created by the MCC prime, or an engine burnout will occur due to the resulting oxygen-rich 
combustion. It was determined from test experience that if the speed were to be less than 4600 
RPM at 1.25 seconds (Figure 5-0a), then it would likely be too low at MCC prime to maintain 
pumping capability. The engine must be shutdown at at 1.25 seconds because, if the speed is 
discovered to be too low later in the start sequence, there is insufficient time to react and shut 
down safely. 

When the FPB prime occurs at 1.4 seconds, there is a rapid rise of pressure at the inlet to the 
HPFTP turbine. Since the turbine back pressure is not provided until MCC prime, this 
pressure rise causes a high turbine pressure ratio and a significant acceleration in the HPFTP 
speed (Figure 5-0b). The higher HPFTP speed is desirable for a cool fuel rich start, however 
the turbine back pressure must be applied (MCC prime) soon to prevent a runaway condition. 

MCC prime is primarily controlled by positioning of the MOV. After an initial delay of 0.20 
seconds, the MOV is slowly ramped to just under 60 percent open. This combination of time 
delay, ramp rate, and position provides a LOX flow rate that causes MCC prime to occur at 1.5 
seconds and creates an engine system balance that will produce a safe low mixture ratio 
(between 3 and 4) for the stabilized operation just prior to activating the closed loop thrust 
control system at 2.4 seconds. When MCC prime occurs at 1.5 seconds, it causes a rapid rise 
in MCC chamber pressure (Figure 5-0c) which, because it increases the turbine back pressure, 
acts as a brake to decelerate the HPFTP (Figure 5-0b). 

The OPOV is used to control OPB prime. Its initial opening is after a delay of 0.12 seconds, 
however, the opening only retracts die valve inlet seal which is designed to provide sufficient 
oxygen to ignite the ASI and to have a small leakage flow into the OPB injector. The valve is 
designed so that the major flow path does not start to open until an indicated position of 46 
percent. The slow ramp shown in Figure 5-0d has no effect on the OPB LOX flow rate except 
to delay until 0.84 seconds when the main flow path through the the valve starts to open. This 
flow path is partially open for about a third of a second before it recloses and the OPB is again 
run on valve leakage flow. The timing for this opening is scheduled to provide sufficient 
oxygen to allow the ASI to ignite the OPB before the second fuel oscillation pressure dip 
recovers and causes a significant decrease in mixture ratio. The next opportunity for ignition 
would be about half a second later. With valve leakage flow, OPB prime occurs at 1.6 seconds 
and causes an increase in drive power to both high pressure turbines. The power increase 
stabilizes at about 2 seconds with the MCC chamber pressure at approximately 25 percent of 
rated power level (RPL). During this time the chamber coolant valve (CCV), which was full 
open at start, is throttled down to 70 percent in order to force additional coolant flow through 
the MCC. The engine is allowed to run at this condition until 2.4 seconds to assure stable 
operation. The additional time period of 0.4 seconds is to allow for and absorb normal 
variations in propellent pressures and temperatures. 
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By using the engine mounted sensors, the main engine controller (MEC) verifies proper 
ignition and operation of the three combustors at 1.7 seconds and again at 2.3 seconds. If no 
malfunctions are discovered the closed loop thrust control system is activated at 2.4 seconds. 
The MEC compares the measured MCC chamber pressure to a pre-programmed chamber 
pressure ramp to RPL and modulates the OPOV in an attempt to zero out any differences. 
During this time, the FPOV is simply moved by the MEC with position changes that are 
proportional to the amount of OPOV movement, and the CCV is commanded open at a rate 
commensurate with the commanded chamber pressure ramp rate. Because of the the engine 
dynamic response characteristics, the resulting chamber pressure lags behind the command by 
about 0.2 seconds. At 3.8 seconds the closed loop mixture ratio control system is activated 
using the FPOV to adjust fuel flow rate until the commanded mixture ratio is achieved. At 5 
seconds the engine has achieved stabilized operation at RPL with a mixture ratio of 6. 

A detailed listing of the events that are initiated, monitored, and controlled by the SSME 
controller during engine startup is provided as Appendix 4. 

5.1.2 SSME Startup Constraints 

Certain physical constraints of the SSME startup define the minimal conditions necessary to 
safely start the engine and define the boundaries that new control strategies must work within. 
These constraints have been identified based on analytical analysis of the SSME, the results of 
SSME hot fire tests, and the results of early development testing. Each of these constraints, 
and failures which have resulted from their violation, are summarized below. 

Prebumer Ignition Time: The high pressure fuel and oxidizer turbine prebumers must ignite 
between 0.75 and 0.80 seconds from start-up to produce the required turbopump acceleration 
to achieve satisfactory start and plateau (the phase during which the engine has settled to an 
intermediate level prior to initiation of closed loop MCC pressure control at t=2.4 seconds) 
performance. Ignition time is governed by the fuel system oscillations and sufficient oxidizer 
flow must be available during the fuel flow pressure dip for ignition at this time. If ignition is 
delayed, the fuel density and fuel flow increase as the hardware chills and the resulting mixture 
ratios and propellant injection flow velocities are not proper for complete and evenly distributed 
combustion in the prebumers resulting in combustion fluctuations and local temperature 
excursions. 

Fuel and Oxidizer Prebumer Oxidizer Flow at Ignition: The prebumer oxidizer flow-rates must 
be sufficient at ignition time to achieve ignition and ensure total combustion. If partial 
combustion occurs, plateau performance is low and ignition of the remaining injection elements 
does not take place until the engine is approaching or has already achieved mainstage. This 
results in large prebumer "pops" (e.g. test 902-081 to 902-084, Engine 0002) and temperature 
spikes as the inlet injection elements are ignited which may cause turbine damage (e.g. test 
902-068, Engine 0002). 

An indication of the oxidizer flow limits can be obtained by examining results of early ignition 
tests. For the initial Integrated Subsystem Test Bed (ISTB, early developmental SSME) tests, 
the Oxidizer Prebumer Oxidizer Valve (OPOV) was commanded open at 300 milliseconds after 
engine start command with a 200 percent per second (%/sec.) ramp rate with satisfactory 
prebumer ignition. The time at which the OPOV starts to open was subsequently changed to 
120 milliseconds after engine start command with no change in prebumer ignition time since 
fuel side oscillations govern the ignition. On the other hand, on test 901-034, when the OPOV 
initial opening ramp was reduced to 100%/sec. (starting at 300 milliseconds after the start 
command) ignition did not occur. 
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Fuel Prebumer Priming Time: The fuel prebumer oxidizer manifold must prime between 1.45 
and 1.55 seconds (nominal) after engine start command. If the fuel prebumer primes early, 
fuel flow may be low due to fuel side oscillations, resulting in a high mixture ratio and 
overtemperature of the High Pressure Fuel Turbine (HPFT). For example, the FPB primed 
early on test 901-178 and 901-179, Engine 0005, with erosion of the HPFT. Prime occurred 
at approximately 1 .25 seconds after engine start on both of these tests. This time is at the 
minimum fuel flow caused by the fuel system oscillations. Delay of prime to 1.5 (+/- 0.05) 
seconds after engine start will result in FPB priming at the maximum fuel flow condition 
produced by the fuel system oscillations. 

Sequential Order of Combustor Primes: Priming of the SSME combustors must occur in a 
specified sequential order to achieve minimum turbine discharge temperatures. The FPB must 
prime first, then the main chamber and, finally, the OPB. Priming of the FPB first is required 
to ensure continued acceleration of the HPFP during start and to insure that the HPFP speed is 
high enough to maintain fuel flow with the increased pump head required at MCC prime. If the 
FPB primes too late, i.e., after the MCC has primed, HPFP speed and, consequently, fuel 
flow may not be sufficient at prebumer prime to prevent damage to the high pressure turbines. 
On test 901-166, Engine 0002, the FPB primed at 1.67 seconds, approximately 100 
milliseconds after the main chamber primed. When the fuel prebumer did prime (at the same 
time as the OPB), HPFP speed was not high enough resulting in a low fuel flow condition 
with excessive HPFT and HPOT temperature. 

Approximately 100 milliseconds after the FPB primes, the MCC should prime. This time 
delay is used to accelerate the HPFP and provide the desired fuel flow margin. At MCC prime, 
the HPFT and HPOT pressure ratios are significantly decreased (increasing back pressure) and 
the turbopump acceleration slows down. The effect on the HPOP is much greater since the 
OPB is not primed and it's acceleration is essentially stopped until OPB prime. The loss of 
HPOP acceleration and continued acceleration of the HPFP increases fuel flow to each 
prebumer. Finally, the OPB prime should occur approximately 100 milliseconds after the 
MCC prime. The increased fuel flow and fuel density to the OPB prevents an overtemperature 
condition at prime. After prime, the HPOP starts to accelerate until the plateau speed levels are 
reached. If the OPB primes too early, fuel flow is not adequate and a HPOT overtemperature 
condition will result with turbine damage. On test 901-164, Engine 0002, the OPB primed 30 
milliseconds before the MCC. Fuel flow to the OPB was not sufficient at this time and 
extensive turbine damage resulted. A similar condition occurred on test 902-107, Engine 
0101, with the OPB priming immediately after the MCC. To provide the required fuel flow, 
the OPB should prime approximately 100 milliseconds after the main chamber has primed. 

MCC Priming Time: The MCC should prime no later then 1.7 seconds after engine start. 
Priming of the main chamber results in increasing the fuel system pressure above critical 
pressure so that the fuel flow oscillations are terminated. The fuel flow oscillations get bigger 
with time and, therefore, MCC prime is required between the second (FPB prime) and third 
oscillation. In addition, priming of the MCC increases fuel density so that the effect of the 
reduced fuel system pressure drop on flowrate is minimized. 

HPFP Speed at MCC Prime: The HPFP speed should be a minimum of 8000 RPM at MCC 
prime. This speed is required so that the reduction in HPFP fuel flow at MCC prime does not 
decay below the pump throttle limit line (which may result in boilout). In addition, this speed 
level insures adequate fuel flow to each prebumer during the MCC and OPB priming sequence. 

Turbopump Speed Ratio: The ratio of HPFP speed to HPOP speed should be a minimum of 
1.2 at the time of MCC prime. The increased HPFP speed relative to the HPOP speed results 
in increased prebumer fuel flow and minimized the possibility of turbine overtemperature. A 
speed ratio of 1.04 at MCC prime occurred on test 902-166, Engine 0002, with HPOT 
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damage. Ratios of approximately 1.0 to 1.1 have also been experienced on the early OPB 
prime tests with HPOT turbine damage. An earlier FPB prime relative to the MCC prime 
results in achieving speed ratios in excess of 1.2. 

Plateau Mixture Ratio: The engine mixture ratio should be between 3.0 and 4.0 to provide the 
desired transition into mainstage. Low plateau mixture ratio caused by poor HPOT 
performance also results in low main combustion chamber pressure producing high HPOT 
discharge temperatures and/or pressure oscillations during the transition into mainstage. 

Mixture ratios above 4.0 may result in a mixture ratio overshoot until the MR loop is closed. 
The thrust ramp into mainstage is controlled by the OPOV only with a cross-feed gain to the 
FPOV. Therefore if mixture ratio is high on the plateau, this condition could result in an 
overshoot in mixture ratio during the upthrust with possible MCC overheating. 

Hardware Conditioning: The engine hardware upsteam of the fuel and oxidizer valves must be 
pre-conditioned prior to engine start so that all latent heat in excess of propellent temperature 
equilibrium is removed. If the oxidizer side hardware is not conditioned properly, the engine 
start transients will be slow. The slow start transients cause low HPFP speed at prime and 
high turbine discharge temperature (test 901-027, ISTB). If the fuel side hardware is not 
conditioned properly, the liquid hydrogen may vaporize causing cavitation of the HPFP and 
turbine overtemperature. 

5.2 Overview of Proposed Approaches 

Several approaches were investigated to evaluate the feasibility and potential benefits of 
implementing closed loop control during the SSME startup. 

For closed loop control to be successful, the SSME must satisfy three important control 
conditions: the SSME must be observable, modelable, and controllable. Observability is the 
ability to discern what state the engine is in. Sensors to directly measure the variables 
associated with each component are not necessary for observability, if that variable can be 
reconstructed from other measurements through observers, models, or filters. However, the 
more complete and more accurate the engine measurements, the higher the performance an 
engine controller may attain since control actions are taken on reliable and trusted data. 
Modelability reflects the degree to which the engine variables making up the desired state vector 
can be accurately described. Controllability is, strictly speaking, the ability to control the 
engine state to arbitrary values in finite time. However, in this investigation the requirements 
for controllability are relaxed to include ‘'improvements*' in the engine startup transient. 
Therefore the engine is considered controllable if the ability exists to mitigate adverse effects of 
external influences, factors inherent to engine startup, or engine anomalies. 

Four stages of engine controllability were defined for the SSME startup as shown in Figure 5- 
1. Stage 1 begins when the engine start command is received and continues until the engine is 
established as a continous system. During stage 1, the engine propellent system (ducts, LOX 
domes, etc.) fill with propellent, combustible mixtures are established in the combustion 
chambers, the combustible mixtures are ignited, and the high pressure turbopumps begin to 
speed up. The goal of the stage 1 start transient is to establish the engine as a continuous 
system in a state suitable for the start sequence to continue and to minimize engine damaging 
transient affects. The discrete events that are characteristic of stage 1 include the ignition of 
propellent gasses in the combustion chambers, the temperature resulting from combustion 
chamber ignitions, the timing and sequence of LOX dome primes, the temperatures resulting 
from the sudden increase in LOX flow when the domes prime, and the speed of the HPFTP 
when the MCC LOX dome primes. The transient nature of stage 1 is indicated by the FPB 
temperature as shown in Figure 5-2. Stage 2 begins after the discrete events related to 
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establishing the engine as a continuous system.have occured and continues until the thrust 
buildup phase of the start sequence (stage 3) is reached.. During stage 2, the engine state is 
transitioned to an equilibrium and allowed to "setde out”. The goal of the stage 2 start transient 
is to transition the engine parameters to a suitable state to enable a safe and reliable thrust 
buildup to mainstage values. Stage 3 is the thrust buildup phase of the start transient and is 
characterized by the initiation of closed loop control of the MCC pressure in the current SSME 
start sequence. Stage 4 starts when the current SSME start sequence initiates closed loop 
control of the engine mixture ratio and represents the mainstage control case. 

The start transient stage which has the highest potential for improvement by using closed loop 
control is stage 1 since the primary engine damaging transients occur during this stage. 
Therefore, the efforts of the start transient investigation are concentrated on the stage 1 start 
transient Additionally, some consideration is given to resolving anomalies that occur in stage 
2, primarily those resulting from conditions during stage 1. Stages 3 and 4 were not 
investigated as part of the start transient investigation since some form of closed loop control is 
currently used during these stages of the start sequence. 

The SSME is not easily observable or controllable and is not perfectly modeled during the stage 
1 start transient. Most engineers in the SSME program, and others who have studied startup 
control of the SSME engine, have made this observation. Because of this, SSME experts have 
had to rely on test firings to support analytical approaches to determine an acceptable SSME 
startup procedure. Therefore, much of the knowledge related to the SSME startup is in the 
form of engineering expertise gained through this endeavor. This investigation relies heavily 
on that expertise to supplement and clarify the results obtained with the SSME transient model. 

Three approaches were investigated for the SSME stage 1 start transient These are: 

a) Extended start sequence 

b) Robust nominal sequence - continuous control of critical engine start variables 

c) Robust nominal sequence - influence coefficient, model-based valve control 

The initial approach for using closed loop control during the stage 1 start transient was to 
extend the start sequence and thereby reduce adverse transient effects. The investigation of the 
extended start sequence provided no indications that any benefit would be realized and the 
approach was abandoned. Within the constraints of the SSME, the nominal start sequence 
provides a near optimal tradeoff between engine startup reliability and adverse transient effects. 
Therefore, the investigation turned to closed loop control approaches that provide a startup that 
is more robust to external influences and engine conditions. The first, continuous multiple 
input/multiple output control, failed due to a lack of observable/controllable variables during the 
SSME start transient. The second approach, an influence model based controller, indicated 
some promise and was the most thoroughly investigated approach. 

5.2.1 Extended Start Sequence 

The initial approach investigated is extending the start sequence while attempting to control 
critical SSME startup parameters such as turbine speeds and temperatures. The philosophy is 
to smoothly bring the SSME up to mainstage, avoiding severe transient effects inherent to the 
current startup. The basic argument for this approach is that the most severe normal start 
transient effect is the potentially turbine blade damaging temperature spikes that occur in the 
prebumer at prebumer ignition and when the FPB LOX dome primes (Figure 5-3 to 5-4). 

The test data shown in Figure 5-3a indicates an ignition temperature spike of about 80 R. 
However, this value is somewhat misleading since: 1) the temperature measured is the fuel 
turbine discharge temperature, not the prebumer temperature, and 2) the temperature sensor 
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used on the engine has a relatively slow time constant . The fuel turbine discharge temperature 
is lower than the prebumer temperature since the hot gasses generated in the prebumer (and 
incident on the first stage turbine blades) pass through a labyrinth of relatively cool hardware 
before exiting the turbine. Once these cooled gasses exit the turbine, the temperature is 
measured with a slow sensor that further attenuates the true reading. Ground tests which 
included a prebumer temperature sensor indicate a much higher temperature spike than is 
indicated by the SSME flight sensors. The SSME system dynamics group evaluated this data 
and determined that the true prebumer temperature excursion during the ignition spike is about 
25 to 27 times greater than that indicated by the HPFT discharge temperature sensors. Using a 
conversion factor of 25, the temperature spike shown in Figure 5-3a would be expected to 
correspond to a maximum prebumer temperature of about 2500R (500 + 25 *80). 

Figure 5-3b shows the fuel turbine discharge temperature calculated by the SSME transient 
model. The transient model results agree with the actual test data in both magnitude and time of 
the ignition spike as indicated by the fuel turbine discharge sensor. The transient model also 
provides an estimate of the actual prebumer temperature as shown in Figure 5-4. The 
calculated fuel prebumer temperatures during the ignition spike agree with the maximum value 
estimated using SSME test data. The agreement between transient model results and measured 
test data provides a degree of confidence that the temperature transients indicated by the 
transient model accurately reflect the true SSME FPB temperature transients during startup. 

Investigation of the extended start sequence identified two major flaws in the approach: 1) the 
transient effects with the current SSME startup that are most critical to engine damage, fuel 
prebumer temperature spikes, are not reduced, and 2) other potentially damaging transient 
effects, most notably sideloading on the engine nozzle, are significantly increased. 

Initially, extending the duration of the fuel prebumer temperature transients was investigated. 
Two fuel prebumer temperature spikes, the ignition spike and the priming spike, are indicated 
in Figure 5-4. The ignition spike is caused by the ignition of the propellent gasses in the 
prebumer when an ignitable mixture ratio is reached. The priming spike is caused by the 
sudden increase in oxidizer flowrate into the prebumer that occurs when the fuel prebumer 
LOX dome is primed. Both fuel prebumer temperature spikes are the result of discrete events, 
i.e. ignition and LOX dome priming. The risetime and duration of the temperature spikes are 
then governed solely by the physical characteristics of the event. For example, when the 
combustable mixture of propellent gasses is ignited, the only time limitation is the propagation 
of the flamefront. Therefore, while modifying the propellent flows in the engine may change 
the time at which the fuel prebumer ignites and the fuel prebumer LOX dome primes, the 
risetime and duration of the resulting temperature spikes will be unchanged. 

Reducing the magnitude of the fuel prebumer temperature spikes was then investigated. The 
prebumer temperature is directly related to the prebumer mixture ratio as demonstrated by 
comparing the fuel prebumer temperature (Figure 5-4) with the fuel prebumer mixture ratio 
(Figure 5-5). Both the fuel and oxidizer prebumers are run very fuel rich and all of the 
oxidizer injected into the prebumers is burned. Since the fuel/oxidizer combustion is the 
source of energy in the combustion gasses, the energy (heat) imparted per unit of combustion 
gasses is directly proportional to the ratio of oxidizer to fuel (mixture ratio). No method of 
reducing the fuel prebumer mixture ratio at ignition or LOX dome prime that was related to 
extending the start sequence could be identified. 

Therefore, based on the above arguments, it is concluded that extending the engine start 
sequence provides no mechanism for reducing the adverse effects of the fuel prebumer 
temperature spikes. 
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Additionally, the effect of extending the start sequence on other engine startup transients was 
investigated. No additional potential benefits were identified. However, several adverse 
effects were noted. The most severe of these are: 1) additional transverse loading of the high 
pressure turbopump bearings, 2) additional thermal loading of the MCC, and 3) additional side 
loading of the engine nozzle. 

Transverse loading of the high pressure turbopump bearings is caused by the vibration of the 
turbopump which increases as its speed passes through the turbopump natural frequencies. 
Slowly bringing the turbopump up to its mainstage operating speed, which is a requirement for 
an extended start sequence, increases the time spent near each natural frequency and 
consequently increases the overall turbopump vibrations. 

Additional thermal loading of the MCC is caused by lower fuel flowrates during startup. 
During startup, the combustion temperature in the MCC is nearly equal to the mainstage 
combustion temperature; 5000R at 1.8 seconds compared to a mainstage value of about 6000R. 
However, the fuel flowrate during startup is significantly less than the fuel flowrate during 
mainstage. Since the fuel flow acts as a coolant for the MCC wall, during startup there is less 
available coolant to the MCC walls than during mainstage operation. The disparity between 
startup and mainstage conditions is accommodated somewhat by closing the chamber coolant 
valve (CCV) and forcing a higher percentage of the available fuel through the MCC coolant 
circuit, but the MCC thermal balance is not achieved until mainstage flowrates are reached. 

Side loading of the engine nozzle is caused by the turbulent flow conditions that exist in the 
nozzle until the engine thrust reaches 80% - 85% of the rated power level (RPL) at sea level. 
Even though the engine is at a reduced thrust level, the flowrates and associated forces are still 
considerable. The combustion gas flow rate through the nozzle at 80% - 85% of RPL is in 
excess of 850 lbm/sec. Nozzle side loading during startup is strikingly indicated during an 
SSME ground test or a space shuttle launch . The SSME visibly "jumps" and jerks from side 
to side during the startup until the nozzle flow becomes laminar at about 85% of RPL. An 
extended start sequence requires that the engine thrust increases to 85% of RPL over a longer 
time period than with the current startup resulting in increased nozzle side loading. 

The investigation of additional transient effects associated with an extended start sequence, 
leads to the conclusion that an extended start sequence is expected to increase the stress levels 
of several major engine components - the high pressure turbopumps, the MCC, and the nozzle. 

The results of the extended start sequence investigation are threefold: 

1) No improvement in fuel prebumer startup temperature transients were identified, 

2) No beneficial transient effects on other major engine components were identified, 
and 

3) Several adverse transient effects were identified for major engine components. 

Therefore, it is concluded that any form of closed loop control designed to extend the SSME 
start sequence has no potential to extend engine life, increase engine reliability, or reduce 
engine maintenance. 

5.2.2 Continous Control of Critical Engine Start Variables 

The results of Section 5.2.1 indicate that the nominal SSME start transients cannot be improved 
upon within the constraints of the existing SSME configuration. However, the nominal start 
transients are extremely sensitive to external influences and engine conditions. For example. 
Figure 5-6 shows the expected increase in the fuel prebumer ignition temperature spike for 
several off-nominal fuel inlet pressures. The FPB ignition spike reaches temperatures of about 
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6500R for fuel inlet pressures significantly less than the nominal 45 psi. Further insight into 
the start transient sensitivities is provided in Section 5.1. 

An approach to make the current start sequence more robust to external influences and engine 
conditions was proposed. The proposed approach was to provide continuous closed loop 
control over the engine variables that are critical to successfully starting the engine and the 
variables that affect engine damaging transients. Each variable would be controlled to mimic 
(or at least approach) the time varying values observed during a nominal startup. 

Based on the startup phenomena and constraints described in Section 5.1, the following events 
and conditions were identified as critical to a nominal engine startup (the proposed engine 
variables to implement the required control are included in parentheses): 

1 ) the time of FPB ignition 

(fuel flow rate and oxidizer flow rate into the FPB) 

2) the time of OPB ignition 

(fuel flow rate and oxidizer flow rate into the OPB) 

3) the time of FPB LOX dome prime 

(FPB LOX dome oxidizer level) 

4) the time of MCC LOX dome prime 

(MCC LOX dome oxidizer level) 

5) the time of OPB LOX dome prime 

(OPB LOX dome oxidizer level) 

6) the speed of the HPFTP when the MCC primes 

(HPFTP speed) 

In addition, the following conditions were identified as critical to minimizing adverse transient 
effects: 


7) the FPB temperature (mixture ratio) at FPB ignition 

(fuel flow rate and oxidizer flow rate into the FPB) 

8) the FPB temperature (mixture ratio) when the FPB LOX dome primes 

(fuel flow rate and oxidizer flow rate into the FPB) 

9) the OPB temperature (mixture ratio) at OPB ignition 

(fuel flow rate and oxidizer flow rate into the OPB) 

10) the OPB temperature (mixture ratio) when the OPB LOX dome primes 

(fuel flow rate and oxidizer flow rate into the OPB) 

If the identified engine variables (fuel flowrate into the FPB and OPB, oxidizer flowrate into 
the FPB and OPB, the three LOX dome levels, and the HPFTP speed) can be controlled to 
replicate the values observed during a nominal startup, then the critical engine startup events 
and transients should mimic those of a nominal engine startup. 

Problems with continuous closed loop control of the start sequence arise due to the actual 
observability and controllability of the proposed variables. Each of the proposed variables is 
theoretically observable and controllable. However, measuring or estimating and controlling 
some of the variables to the accuracy required for useful engine control is extremely difficult or 
impossible within realistic constraints imposed by the SSME configuration (with the exception 
of measuring the HPFTP speed). 

First consider the fuel flowrate into the FPB and OPB. Observability can be readily achieved 
with flowmeters incorporated into the fuel lines leading to each of the prebumers. This 
statement is based on the premise that a flowmeter can be designed that accurately measures 
small gasseous hydrogen flowrates at low pressures and also measures (or at least survives) 
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gasseous hydrogen flowrates up to 86 lbm/sec at over 6000 psi during mainstage operation. A 
difficult task, but one that is seemingly realistic. Optical flow measuring techniques exist 
(Laser induced pulse/echo techniques) that technically should be able to measure the low level 
flowrates if cost and reliability issues are acceptable. 

Controllability of the fuel flow into the FPB and OPB is not available with the existing SSME 
configuration, but limited control can be achieved with valves incorporated into the fuel lines 
leading to each prebumer. Control is limited by the availability of gasseous hydrogen in the 
system. The MFV is open to 100% at the beginning of the start transient and fuel flowrates 
through the system oscillate as described in Section 5.1. If a pressure dip occurs at a time that 
more fuel is required in a prebumer, it may simply not be available no matter how far the 
prebumer fuel valve is opened. Theoretically, during start, the fuel path upstream of the 
prebumer fuel valves can be operated so that the pressure is always above the minimum 
required to supply the maximum nominal flowrate to the prebumers, but this results in a certain 
amount of stagnation in that part of the system. The stagnation causes more of the engine 
hardware latent heat to be expended in warming up gasseous hydrogen rather than expanding 
liquid hydrogen (the driving force responsible for starting the engine). The feasibility of 
providing positive pressure in this manner while extracting sufficient energy from the engine 
hardware to power the early start transient is not clear. Therefore, controllability of the fuel 
flow into the prebumers is left an open issue. 

The amount of oxidizer actually flowing into the FPB and OPB during engine startup is very 
difficult, perhaps impossible with the existing SSME configuration, to observe. Liquid 
oxygen is introduced into a labyrinth of relatively hot hardware through the LOX dome and 
injector assembly. The oxygen boils and some of the oxygen remains in the LOX dome while 
some of the oxygen flows through the injector into the prebumer. No realistic means of 
directly measuring the oxygen flowrate actually entering the prebumer could be identified. 
Estimating the oxidizer flowrate into the prebumer has difficulties that appear prohibitive. 
Reliable models of the oxidizer dome filling and the corresponding oxidizer expulsion into the 
prebumer are not available and are not likely due to the complexities of the reaction and 
sensitivity to a multitude of parameters (LOX temperature, hardware temperature, oxidizer inlet 
pressure, prebumer backpressure, time history of oxidizer flow into the cavity, engine 
orientation, etc.). Therefore, to estimate the oxidizer flowrate into the prebumer, the oxidizer 
entering the LOX dome and the oxidizer remaining in the LOX dome must be measured. 
Measuring the oxidizer flow into the LOX dome requires either a flowmeter downstream of the 
prebumer oxidizer valve, since some of the oxidizer entering the valve is rerouted to supply 
oxidizer to the ASI, or another flowmeter on the ASI line. A flowmeter downstream of the 
prebumer oxidizer valve introduces additional hot hardware for the oxidizer to encounter. The 
prebumer oxidizer flowmeter must be able to accurately measure the mass flowrate of two- 
phase, boiling, cryogenic oxygen for low flowrates and still measure (or at least survive) liquid 
oxygen flow rates up to 79 lbm/sec at 6800 psi during mainstage. It seems unlikely that such a 
flowmeter could be designed that meets the engine reliability requirements. The original LOX 
flowmeter was removed from the SSME because it presented too great a risk. Even allowing 
that such a flowmeter can be designed, severe difficulties still exist with measuring the oxidizer 
level in the LOX dome. 

The oxidizer flowrate into the prebumer is entirely dictated by (and effects) events occuring in 
the prebumer LOX dome, therefore the oxidizer flowrate into the prebumer cannot be 
controlled independently from the LOX dome priming event. Additionally, the same 
sensitivities that inhibit estimating LOX dome filling inhibit reliable control of the oxidizer 
flowrate into the prebumer since the only mechanism for getting oxidizer into the prebumer is 
through the LOX dome. Therefore, for the purpose of continuous closed loop start sequence 
control, the oxidizer flowrate into the prebumers lacks the required controllability. 
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The LOX dome oxidizer level is not reliably modellable as described above. Therefore, a 
means of directly measuring the oxidizer level was considered. It is critical to note that the 
oxidizer level that must be measured refers to the amount of liquid oxidizer in the LOX dome 
cavity, not the height of the two phase fluid. Therefore, the required measuring device must be 
capable of measuring the volume of the LOX dome cavity occupied by liquid oxygen under 
boiling conditions. No such device or technique could be identified that is realistic for 
application to the LOX dome. 

Controllability of the LOX dome filling appear inadequate for continuous closed loop control of 
the start sequence by the same arguments that discount controllability of the oxidizer flow into 
the prebumer. 

HPFTP speed is directly measurable to a high degree of accuracy during the start transient. 
However, controllability of die HPFTP speed is not achieved until the fuel prebumer lox dome 
primes and enables some degree of control over the amount of energy available to the high 
pressure fuel turbine. The lack of controllability until the fuel prebumer LOX dome primes is 
shown by Figures 5-7 and 5-8. Figure 5-7 indicates the position of the FPOV during the start 
transient. The FPOV is the actuation that most strongly affects the HPFTP speed. Figure 5-8 
shows the HPFTP speed during the start transient. Changes in the FPOV position have no 
detectable affect on the HPFTP speed until after 1.4 seconds when the fuel prebumer LOX 
dome primes. After 1.4 seconds, changes in the FPOV position cause noticeable changes in 
the HPFTP speed. 

Therefore: 

1) the fuel flowrate into the prebumers is observable and somewhat controllable 

2) the oxidizer flowrate into the prebumers is not observable and not controllable 

3) the LOX dome oxidizer levels are not observable and not controllable 

4) the HPFTP speed is observable and controllable 

Based on the limited observability and controllability of the identified variables, it was 
concluded that closed loop control of the SSME start sequence based on measurement and 
control of the critical engine start variables was not feasible. 

5.2.3 Influence Model Based Controller 

The investigation of continuous control of critical engine start variables, described in Section 
5.2.2, indicates that the engine variables that need to be controlled to ensure a safe and reliable 
engine startup are inadequately observable and controllable during the stage 1 start transient. 
Therefore, any feasible closed loop control strategy for the stage 1 start transient cannot rely on 
observation and control of the engine variables primarily responsible for the start transient 
phenomena described in Section 5.2.2. Therefore, a control strategy based on relating only 
observable variables to the stage 1 start transient phenomena was investigated. The selected 
approach to implementing the control strategy was to base the start transient control on the 
influence that observable external factors, engine conditions, and control variables are expected 
to have on the start phenomena - an influence model. The control strategy investigated is to 
quantify the influence of external factors and engine conditions, combine the individual 
influences of each factor and condition, and then determine changes in the engine control 
variables that offset the non-control influences. 

A simple example of the influence model based control strategy is brewing a pot of coffee 
using an automatic drip coffee maker. Assume 3 scoops of coffee grounds and 10 cups of 
water produce the nominal pot of coffee. Further assume that 8 cups of nominal coffee are 
required for a given purpose. The "correct" amount of coffee grounds for the off-nominal 
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amount of water is estimated by an operator that has used the machine before and knows that 2 
cups less water requires 1/2 scoop fewer coffee grounds. The relationship between cups of 
water and scoops of coffee is a simple influence model. The external factor (2 cups less water) 
is observed, the expected influence (strong coffee) is estimated, and the control response (1/2 
scoop fewer coffee grounds) to offset the external influence is implemented. It is important to 
note that the operator generally has little knowledge of the chemistry associated with brewing 
coffee or even the events occuring within the coffee maker and is still able to control the coffee 
state (temperature, taste) to near nominal, for a variety of water levels. It is equally important 
to note that if the coffee maker has an unobservable failure (e.g. heating coil bums out) the 
resultant coffee state will be far from nominal (cold). Additionally, if asked to make 1 cup of 
coffee, the amount of coffee grounds used by the operator (based on an influence model 
developed around a nominal 10 cup water level) is likely to be far from the "correct" value. 

The example used above illustrates three important features of an influence model: 1) a useful 
model can be developed without observation or complete understanding of the interactions that 
relate the external influence to the desired output, 2) unobservable anomalies are not accounted 
for, and 3) the model is useful only over the range of observed (or simulated) influences used 
to develop the model. Generally, for a complex system, the observed influences consist of 
limited perturbations to the nominal system. To explore all combinations of external influences 
and internal conditions is not feasible because of the large number of off-nominal combinations 
that must be considered. Therefore, practical influence models are limited to perturbations 
around a nominal system. 

For the SSME stage 1 start transient, the influence model is a model of the start transient in 
which the influence of external factors (e.g. propellent inlet pressures), engine conditions (e.g. 
high pressure turbine torques), and control variables (e.g. FPOV position) on the controlled 
engine phenomena are characterized by observation and simulation. 

Investigation of the influence model based control strategy consisted of 1) identifying stage 1 
start transient phenomena to be controlled, 2) evaluating the controllability of the selected 
phenomena, 3) developing a limited influence model for the SSME start transient, 4) simulating 
an anomaly in an external influence (low fuel inlet pressure), and 5) simulating an anomaly in 
an internal engine condition (MOV error) 
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5.2.3.1 Stage 1 Start Transient Control Phenomena 

The stage 1 start transient phenomena selected as control parameters are those identified in 
Section 5.2.2 as critical to a safe and reliable engine startup 

The critical stage 1 start transient phenomena (as described in Section 5.1) were identified as: 

1) the time of FPB ignition 

2) the time of OPB ignition 

3 ) the time of FPB LOX dome prime 

4) the time of MCC LOX dome prime 

5) the time of OPB LOX dome prime 

6) the speed of the HPFTP when the MCC primes 

7) the FPB temperature at FPB ignition 

8) the FPB temperature when the FPB LOX dome primes 

9) the OPB temperature at OPB ignition 

10) the OPB temperature when the OPB LOX dome primes 

5.2.3.2 Controllability and the Influence Model 

The SSME digital transient model was used to evaluate several off-nominal FPOV and OPOV 
start sequences. The results of this evaluation were used to assess the controllability of the 
selected start transient phenomena. Additionally, the results were used to develop a limited 
influence model for the stage 1 start transient. The limitations on the influence model are: 1) 
only the FPOV and OPOV are used as control valves, 2) no multiple influences were 
investigated, and 3) influences were quantified only over a limited range around the nominal 
engine state. TTie limitations result from the desire to limit the number of simulation runs and 
the inability (within the scope of this effort) to modify the SSME digital transient model. No 
fundamental limit exists on the capability to develop a comprehensive influence model for the 
stage 1 start transient. 

Four test cases were run: 1) a positive offset in the FPOV flow area [approx. 0.003 in 2 ], 2) a 
positive offset in the OPOV flow area [approx. 0.002 in 2 ], 3) a positive offset in the first 
FPOV notch time [+0.05 seconds], and 4) a negative offset in the FPOV first notch time [ - 
0.10 seconds]. 

The FPOV and OPOV flow area offsets are shown in Figures 5-9 and 5-10. The offsets were 
implemented by increases the valve leakage value in the digital transient model and are labeled 
as "FPOV leak" and "OPOV leak" in the subsequent data plots. The relevant digital transient 
model data resulting from the FPOV and OPOV flow area offsets is shown in Figure 5-11. 
Changes in critical start transient phenomena resulting from the FPOV and OPOV flow area 
offsets are listed in Table 5-1. Table 5-1 lists the nominal value for each phenomena in the 
"Nominal" column and lists the changes from nominal in the "FPOV" and "OPOV" columns. 

The FPB ignition time is measured as the time that the main spike of the first temperature 
transient occurs in the fuel prebumer (Figure 5- lid). The OPB ignition time is measured as 
the time that the main spike of the first temperature transient occurs in the oxidizer prebumer 
(Figure 5-1 lb). The FPB prime time is measured as the time when the fuel prebumer pressure 
begins to rise rapidly (Figure 5-1 lc). The OPB prime time is measured as the time when the 
oxidizer prebumer pressure begins to rise rapidly (Figure 5-1 la). The MCC prime time is 
measured as the time when the main combustion chamber pressure begins to rise rapidly 
(Figure 5-1 If). The HPFTP speed at the first plateau is measured where the HPOTP speed 
levels out after MCC prime (Figure 5-1 le). The FPB temperature at ignition is measured as the 
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maximum temperature reached during the first fuel prebumer temperature transient (Figure 5- 
1 Id). The FPB temperature at FPB LOX dome prime is measured as the maximum 
temperature reached during the second fuel prebumer temperature transient (Figure 5-1 Id). 
The OPB temperature at ignition is measured as the maximum temperature reached during the 
first oxidizer prebumer temperature transient (Figure 5-1 lb). The OPB temperature at OPB 
LOX dome prime is measured as the maximum temperature reached during the second oxidizer 
prebumer temperature transient (Figure 5-1 lb) 

The offsets in the first FPOV notch time are shown in Figure 5-12. Changes in critical start 
transient phenomena resulting from the offset first FPOV notch time are listed in Table 5-2. 
Table 5-2 lists the nominal value for each phenomena in the "Nominal'' column and lists the 
changes from nominal in the "0.60" and ”0.75’’ columns. The complete set of digital transient 
model data plots for each case is provided in the appendices. Appendix 1 contains the nominal 
simulation. Appendix 2 contains the data plots for an FPOV first notch time of 0.60 seconds. 
Appendix 3 contains the data plots for an FPOV notch time of 0.75 seconds. The data 
summarized in Table 5-2 was measured from the data plots in the appendices in the manner 
described for the offset FPOV and OPOV flow area simulations. 

The digital transient model indicates that each of the selected start transient phenomena is 
controllable. Furthermore, the data summarized in Tables 5-1 and 5-2 define a simple 
influence model for the stage 1 start transient The influence on controlled phenomena (FPB 
ignition, FPB prime time, etc.) by control variables (OPOV and FPOV position/time) are 
clearly defined for a limited rage of control options. 

5.2.3.3 Simulation of a Low Fuel Inlet Pressure Anomaly 

The nominal fuel inlet pressure during SSME startup is 45 psi, with an allowable window of 
43 to 47 psi for successful SSME startup. The stage 1 and 2 start transient was simulated with 
the digital transient model using a fuel inlet pressure of 42 psi to represent a degrading external 
influence on the start transient. The most notable and potentially damaging anomaly in the 
engine is a large increase in the magnitude of the FPB ignition temperature transient (Figure 5- 
13c). 

If the influence model were completed, the fuel inlet pressure (an external factor) would be 
measured and the corresponding start transient influence would be estimated as a 2400 R 
increase in the FPB ignition temperature. Then an offsetting control action would be 
determined. In this case, the anomaly was manually evaluated and determined to be a 2400 R 
increase in the magnitude of the FPB ignition temperature. As indicated by the influence data 
shown in Table 5-1, an increase of 0.003 in 2 in the FPOV flow area is expected to result in a 
100 R increase in FPB ignition temperature. The ratio of delta FPOV flow area to delta FPB 
ignition temperature results in an influence coefficient of 0.00003 in 2 /R. Therefore, the 
influence data indicates that a reduction in valve area of 0.072 in 2 is required to reduce the FPB 
ignition temperature to its nominal value. By manually evaluating the start transient anomalies 
and using the influence data to estimate effective control actions, the influence model based 
control strategy is replicated. 

Figure 13 shows the data plots from three digital transient model runs: 1) the nominal case - 
fuel inlet pressure of 45 psi, 2) the anomalous case - fuel inlet pressure of 42 psi, and 3) the 
anomalous case with a modified valve sequence. 

Figure 5-14 summarizes the digital transient data by providing bar graphs of the selected start 
transient phenomena for the nominal simulation, simulation with a fuel inlet pressure of 42 psi, 
and the simulation with a fuel inlet pressure of 42 psi and a modified valve sequence. 
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Figures 5-13 and 5-14 indicate that the FPB ignition temperature is the only start phenomena to 
significantly differ from the nominal case when the fuel inlet pressure is reduced and the 
original start sequence is used. A FPB ignition temperature of 4800 R is indicated. When the 
control action determined manually from the influence data is incorporated into the simulation, 
the simulation shows a decrease in the FPB ignition temperature from 4800 R to about 2700 R. 
The decrease in FPB ignition temperature is close to that estimated with the influence data. 
However, severe transient affects were generated in other start transient phenomena by the 
control action as shown in Figure 5-14. 

The simulation of the influence model based control strategy seems worse than the open loop 
case. However, the anomaly upon which the control action was based is significantly 
improved. These facts indicate that the influence model based control strategy has the potential 
to reduce stage 1 start transient anomalies, but requires a more extensive influence model to be 
effective. 

5.2.3.4 Simulation of a Main Oxidizer Valve Anomaly 

The digital transient model was used to simulate an anomalous engine condition, a misaligned 
main oxidizer valve (MOV). The valve resistance was changed in the model so that at a 
position of 60% open the valve resistance was equivalent to a normal MOV at 55% open. 
Additionally, a simulation was run with the misaligned MOV and an influence model based 
control strategy employed. 

For the influence model based control strategy used to determine the modified start sequence in 
the final simulation the following parameters are relevant: 

1) The observable engine condition is the oxidizer system effective resistance (OSER) defined 
as: 


Oxidizer System (OSER) = Hi gh Pressure Oxidizer Discharge Pressure 

Effective Resistance (Oxidizer Flow) 2 

2) The start transient phenomenon to be addressed is the HPFTP speed at MCC LOX dome 
prime time. 

3) The control action considered is a change in the MOV position. 

The control strategy consists of measuring the amount that the OSER is away from nominal, 
estimating the affect the off-nominal value of OSER will have on the HPFTP speed when the 
MCC LOX dome primes, and determining the change in MOV position required to counteract 
the estimated HPFTP speed anomaly. 
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The influence coefficients were defined from the simulation results as: 


A HPFTP Speed at MCC LOX Dome Prime 300 RPM 


Influence Coefficient (1) = -7500 

AOSER -0.04 


A MOV Position + 5% 

Influence Coefficient (2) = -0.0167 


A HPFTP Speed at MCC LOX Dome Prime -300 RPM 

Figure 15 shows the data plots from three digital transient model runs: 1) the nominal case, 2) 
the anomalous case - MOV misaligned, and 3) the anomalous case with a modified valve 
sequence. 

Figure 5-14 summarizes the digital transient data by providing bar graphs of the selected start 
transient phenomena for the nominal simulation, simulation with misaligned MOV, and the 
simulation with a misaligned MOV and a modified valve sequence. 

The results indicate that the HPFTP speed when the MCC LOX dome primes is much closer to 
the nominal value of 14500 RPM in the controlled case than in the open loop case (Figure 5- 
15f). 

5.2.3 .5 Summary of Influence Model Controller Investigation 

The fuel inlet pressure anomaly and the MOV anomaly simulations indicate that the control 
strategy is effective at bringing single start transient phenomena closer to their nominal values 
under anomalous conditions. However, other aspects of the start sequence were significantly 
degraded during the low fuel inlet pressure anomaly. 

The study was performed as a feasibility demonstration and only single start transient 
phenomena were considered in evaluating a control response using only a specific valve. To 
fully evaluate the utility of the influence model based control strategy, a complete influence 
model needs to be developed that evaluates the influence on all of the start phenomena when 
determining the control response and determines the response for all of the control valves. 

5.3 Conclusions of The Closed Loop Start Sequence Investigation 

It appears that any form of control designed to slow down the SSME start sequence has no 
potential to extend engine life, increase engine reliability, or reduce engine maintenance. 
Investigation of extending the duration of the start sequence shows no improvement in fuel 
prebumer startup temperature transients, no beneficial transient effects on other major engine 
components,an increase in MCC thermal loading, an increase in transverse loading of the high 
pressure turbopump bearings, and an increase in nozzle side loading. 

Continuous control of the engine critical start variables during the early start sequence (0.0 to 
1.6 seconds) is not feasible because the critical engine variables (ignitions, priming, flowrates) 
have limited observability and controllability during this period. 

Closed loop control based on an influence model appears to hold some potential for improving 
the robustness of the current start sequence. Simulations with limited influence models resolve 
single transient anomalies but seem to cause larger anomalies elsewhere in the start sequence. 
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A full influence model that takes into account all of the critical startup events and evaluates the 
influence of each valve is required for a more thorough evaluation. 

5.4 Recommendations for Further Study 

Two areas for further study are suggested by the results of the investigation performed under 
this contract. 

1. Development and evaluation of a full influence model for control of the early start sequence. 

2. Evaluation of a modified engine in which observability and controllability of critical start 
transient variables is possible. The limitation with the current engine configuration seems to be 
the time before the LOX domes prime, it is therefore recommended that an investigation along 
this path include simulation of an engine in which the oxidizer system is fully primed prior to 
initiating engine start 
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Table 5-1 Start Transient Changes for Offsets in FPOV and OPOV 
Flow Areas 


Change in Row Area 

None 

(nominal) 

FPOV 

OPOV 

FPB Ignition Time, @ Main Spike (seconds) 

0.73 

0 

0 

OPB Ignition Time, @ Main Spike (seconds) 

1.0 

0 

0 

FPB Prime Time (seconds) 

1.41 

-0.02 

-0.02 

OPB Prime Time (seconds) 

1.70 

-0.04 

-0.09 

MCC Prime Time (seconds) 

1.48 

0 

-0.01 

HPFTP Speed @ Plateau (RPM) 

14500 

+500 

+100 

FPB Temperature, Maximum @ FPB Ignition (°R) 

2400 

+100 

0 

FPB Temperature, Maximum @ FPB Prime °R) 

2200 

+100 

0 

OPB Temperature, Maximum @ OPB ignition (°R) 

760 

-20 

+240 

OPB Temperature, Maximum @ OPB Prime (°R) 

630 

0 

+70 
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Table 5-2 Start Transient Changes for Changes in FPOV Notch Time 


1st FPOV Notch Time (seconds) 

, 0.70 * 
( nominal ) 

0.60 

0.75 

FPB Ignition Time, @ Main Spike (seconds) 

0.73 

- 0.03 

+ 0.01 

OPB Ignition Time, @ Main Spike (seconds) 

1.0 

+ 0.03 

0 

FPB Prime Time (seconds) 

1.40 

+ 0.02 

- 0.02 

OPB Prime Time (seconds) 

1.65 

+ 0.03 

+ 0.01 

MCC Prime Time (seconds) 

1.47 

- 0.05 

+ 0.01 

HP FTP Speed @ Plateau (RPM) 

14500 

-500 

+200 

FPB Temperature, Maximum @ FPB Ignition (°R) 

2400 

-200 

+200 

FPB Temperature, Maximum @ FPB Prime (°R) 

2200 

-350 

-1150 

OPB Temperature, Maximum @ OPB Ignition (°R) 

720 

+200 

-60 

OPB Temperature, Maximum @ OPB Prime (°R) 

580 

0 

0 
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Figure 5-2 SSME FPB Temperature During Startup 
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Figure 5-4 SSME Fuel Preburner Temperature 

( SSME Transient Model) 
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Figure 5-6 FPB Ignition Temperature for Off-Nominal Fuel Inlet Pressures 
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Figure 5-9 FPOV Offset used to Investigate Engine Controllability 



time (seconds) 


Figure 5-10 OPOV Offset used to Investigate Engine Controllability 


RI/RD91-158 





Figure 5-1 la Engine Response to FPOV and OPOV Flow Area Offsets 








Figure 5-1 1c Engine Response to FFOV and OPOV Flow Area Offsets 



Figure 5-1 Id Engine Response to FPOV and OPOV Flow Area Offsets 
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Figure 5-1 1e Engine Response to FPOV and OPOV Flow Area Offsets 
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Figure 5-1 If Engine Response to FPOV and OPOV Flow Area Offsets 
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Figure 5-1 3a Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-1 3b Simulation of Fuei Inlet Pressure Anomoly 
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Figure 5-1 3c Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-1 3d Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-1 3e Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-1 3f Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-1 3g Simulation of 


bbbbbbbbb 


BB^faBBBBBBBB 


■BIBBIBBBIBB^IBIBBIBBIB 

BBBBBBBBBBBJHB1BBBBBBBBB 


■■■■■■: 


mmunmimummuMumi 


bbbbbbbb^bbbbbbbbbbbbbbb 

BBBBBBBPCIBBBBflaflflflBBBBBB 


tUI 


llllllVNII!iIIIIIIIIIIIII 


im 


bbbbbbbbvzbbmbbbbbbmbbI 

■■■■■aaiKiiiiiiiiMiiMi 


BBBKBflB^BBBBBBBBBBBBBBBB 


BBBBBBnBBBBBBBBBBBBBBBI 


■BniBItlBIBIBIBBI 
BBUflBnBBBflBBBBBI 
BB1BB1BBBBBBBBBI 
BB IBBBBBBBBBBBfll 


IBBBBBB 

IBBBBBB 


II1BIIIBIBBBIBIIBUBRBBB 


mi 


BBBBRBBBBBBfli 

■■■■maaaiaa 


111 


mi 


ini 


BBBBBBBBBBBBB 


MBRBBIBIBI 
3BCIIBIBIM 
PXBBBBBBBBBBBBB 


1.4 1.6 1.8 2.0 2.2 2.4 2.6 


- S£CQNQS 


I Inlet Pressure Anomoly 


•I* » 


1-158 


SPEED - RPH 


29/ 8/90 


HIGH PRESSURE FUEL PUMP SPEED 

— D WHO atpdtm stan run nominal 7/90 

“DWHO stan run 42.0 fuel in pr 8/17/90 

"‘DWHO start run 42.0 fuel in pr with valve changes 8/17/90 



Figure 5-1 3h Simulation of Fuel Inlet Pressure Anomoly 
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Figure 5-14a Summary of Fuel Pressure Anomoiy & Accomodation 
Simulated Start Transient - LOX Dome Prime Times 
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Figure 5-1 4b Summary of Fuel Pressure Anomoiy & Accomodation 
Simulated Start Transient - Preburner Temperatures 
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Figure 5-1 4c Summary of Fuel Pressure Anomoiy & Accomodation 
Simulated Start Transient - HPFTP Speed 
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Figure 5-14d Summary of Fuel Pressure Anomoiy & Accomodation 
Simulated Start Transient - Preburner ignition Times 
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Figure 5-1 5a Simulation of MOV Anomoiy 
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Figure 5-1 5b Simulation of MOV Anomoiy 
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Figure 5-1 5c Simulation of MOV Anomoly 
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Figure 5-1 5d Simulation of MOV Anomoly 
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Figure 5-15e Simulation of MOV Anomoiy 
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Figure 5-1 5f Simulation of MOV Anomoly 
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Figure 5-1 5g Simulation of MOV Anomoiy 
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Figure 5-1 6d Summary of MOV Anomoly & Accomodation 
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SECTION 6 ICS FUNCTIONAL FRAMEWORK SIMULATION 


The objective of the ICS functional framework simulations is to demonstrate the feasibility of 
key features of the framework. Key features demonstrated are: 1) the ability to control engine 
variables other than thrust and mixture ratio while maintaining a specified thrust and mixture 
ratio, 2) the ability to rapidly and smoothly change engine variables using a multivariable 
controller, and 3) the ability to coordinate a three engine cluster using downthrust factors as 
feedback. Similiar rocket engine control objectives have been demonstrated by NAS A-LeRC 
and are presented in Reference 2. Since the goal of the simulation effort is to demonstrate 
feasibility, no effort to optimize the control gains was expended beyond that required to 
demonstrate the control feasibility. 

The MATRIXx simulation environment was selected for this effort since a detailed simulation 
of the SSME dynamics was available in this environment. The detailed SSME dynamic model 
used in this effort was implemented in MATRIXx by NASA-LeRC based on equations 
provided by Rocketdyne and was made available by NASA-LeRC for this program. 

The general control strategy employed in the ICS framework consists of a propulsion level 
controller and three engine level controllers. The propulsion level controller implements thrust 
control over the three engine cluster. The engine level controller implements additional engine 
variable control within the constraints set by the propulsion level controller. 

The engine level controller is simulated to demonstrate the feasibility of controlling engine 
variables to desired values while maintaining mission thrust and mixture ratio constraints. 
Initially, a non-interacting multiple input controller is implemented as a proof of concept. Then 
the relationships between relevant engine variables is defined and an interacting multiple 
input/multiple output controller is implemented. Finally, the engine thrust and downthrust 
factor responses are characterized to define a simplified engine model. 

The propulsion level controller simulation uses three simplified engine models to demonstrate 
thrust distribution between the engines in response to degradations as indicated by the 
downthrust factor. Several demonstration cases are run and an actual SSME failure case is 
simulated. 

6.1 Engine Level Controller Simulations 

6.1.1 Engine Level Simulation Overview and Goals 

The goal of the ICS engine level controller simulation is to demonstrate the feasibility of 
controlling potentially degrading engine variables while maintaining mission requirements for 
engine thrust and engine mixture ratio. 

To simplify the problem, only the fuel prebumer oxidizer valve (FPOV), the oxidizer prebumer 
oxidizer valve (OPOV), and the oxidizer prebumer fuel valve (OPFV) were considered as 
control valves throughout the simulation. The FPOV and OPOV are currently used on the 
SSME and the OPFV is an additional valve proposed as part of the phase I ICS baseline 
functional framework that controls the distribution of fuel between the high pressure turbines. 
Additionally, only the thrust command is set by the propulsion level controller. The mixture 
ratio is controlled to a fixed value of 6.0. 

The potentially degrading engine variables selected for control are the high pressure fuel turbine 
(HPFT) temperature and the high pressure oxidizer turbine (HPOT) temperature. The high 
pressure turbines are currently run at temperatures near the damage limits (redlines) during 
SSME mainstage operation. The HPFT temperature is especially high and contributes to the 
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life limits of turbine components such as turbine blades. The control strategy implemented is to 
force the ratio turbine temperature/temperature redline (T/R) to be equal for both high pressure 
turbines. The rationale for forcing T/Rs to equal values is: 

1) The temperature redline value for each turbine indicates the temperature at which the damage 
rate is so great that the engine is expected to fail before mission completion. 

2) The damage rate is estimated to be directly related to turbine temperature. 

3) The relative damage rate for each turbine is therefore estimated as turbine temperature / 
temperature redline (T/R). 

4) For a given set of engine fuel and oxidizer flowrates, the high pressure turbine temperatures 
are inversely related. 

5) The goal of the controller is to maximize total engine life. 

6) Total engine life is maximized when the damage rates for the high pressure turbines are 
equal. 

(i.e. HPFT temperature/HPFT redline = HPOT temperature/HPOT redline) 

The overview of the ICS engine level controller simulations is shown in Figure 6-1. The thrust 
level command (from the ICS propulsion level controller) and the mixture ratio command 
(fixed at 6.0) are converted into engine variable commands (fuel and oxidizer flowrates) that 
can be implemented by a combination of the FPOV, OPOV, and OPFY positions. Valve 
commands are issued that resolve errors in the commanded fuel and oxidizer flowrate while 
forcing the high pressure turbine T/Rs to be equal. Additionally, the main combustion chamber 
(MCC) pressure and the HPFT temperature/redline ratio are fed back to the propulsion level 
controller. The MCC pressure is used to estimate engine thrust and the HPFT 
temperature/redline ratio provides a simplified downthrust factor. The simulated functions 
represent the Engine Command Genererator, the Primary Actuator Command Generator, and 
the high pressure turbine temperature function of the Engine Coordinator shown in Figure 3- 
la. The propellent flowrates are used as the controlled variables at the engine level to reflect 
the RREICS framework philosophy of controlling each propulsion subsystem independently to 
meet the overall propulsion system requirements. Even though controlling the propellent feed 
system flowrates (instead of controlling thrust and mixture ratio directly) has little meaning in 
the case of the SSME, the applicability of controlling the propellent feed system to an integrated 
propulsion system warrants the additional effort. 

6.1.2 Non-Interacting Multiple Input Control 

The first simulation objective is a proof of concept of the ICS engine level control objectives 
for the SSME with the addition of the OPFV. The specific goals of the proof of concept 
simulation are to show that: 1) the high pressure turbine temperatures can be controlled to equal 
values of T/R and 2) the fuel and oxidizer flowrates can be maintained at the commanded 
values. 

Figure 6-2a shows the proof of concept simulation layout . The superblock labeled "ssme" is 
the detailed ssme model and represents the dynamics of the engine and valves. The superblock 
labeled "e2" is the valve controller. External inputs to the simulation are the commanded 
engine fuel flowrate and the commanded oxidizer flowrate. Unity feedback of the simulated 
propellent flowrates is used to calculate the fuel flowrate error (Mf_ERROR) and the oxidizer 
flowrate error (Mo_ERROR). The temperature error is calculated as the difference between the 
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HPFT and the HPOT temperatures normalized by the inverse of the corresponding redline 
values (1905R for the HPFT, 1760R for the HPOT). 

The valve controller is a non-interacting multiple input controller that consists of three 
independent control loops. The FPOV is commanded based on fuel flowrate errors. The 
OPOV is commanded based on oxidizer flowrate errors. The OPFV is commanded based on 
turbine temperature errors. Integral control is used for each valve control loop. The gain of 
each control loop is the sensitivity of the controlled parameter to the control valve as determined 
by baseline simulation runs. 

Inputs to the proof of concept simulation are a constant 148 lbm/second for the engine fuel 
flowrate and a constant 893 lbm/second for the engine oxidizer flowrate. The input values 
represent the propellent flowrates required to achieve 100% of rated power level (RPL) for the 
SSME. 

The results of the simulation are shown in Figures 6-2c, 6-2d, and 6-2e. Initial oscillations in 
the data are attributed to anomalies caused by initialization of the simulation and are not 
considered "real” data. Therefore, interpretation of the simulation results begins after the initial 
oscillations have settled out. Figure 6-2c shows that the temperature error was forced to 0.0 as 
expected. Figure 6-2d shows the commanded engine fuel flowrate (solid line) and the actual 
fuel flowrate (dashed line). The actual fuel flowrate oscillates around the commanded value 
and appears to be settling to the commanded value. Figure 6-2e shows the commanded engine 
oxidizer flowrate (solid line) and the actual oxidizer flowrate (dashed line). The actual oxidizer 
flowrate oscillates around the commanded value and appears to be settling to the commanded 
value. 

With the proof of concept controller, the HPFT temperature reached a steady state value of 
about 1720R (T/R = 0.903) and the HPOT temperature reached a steady state value of about 
1600R (T/R = 0.909) for a simulated 100% RPL. With the baseline SSME controller, the 
HPFT temperature at 100% RPL would be about 1810R (T/R = 0.95) and the HPOT 
temperature at 100% RPL would be about 1370R (T/R = 0.78). The engine life limiting 
damage rate is reduced from 0.95 for the baseline SSME to 0.90 for the SSME with the ICS 
control strategy. 

Based on the proof of concept simulation, it appears that the high pressure turbine temperatures 
can be controlled while maintaining the commanded propellent flowrates using the SSME with 
the addition of an OPFY. 

6.1.3 Interacting Multiple Input/Multiple Output Controller 

The non-interacting multiple input controller implemented and described in Section 6.1.2 
demonstrated the feasibility of the ICS engine level control strategy. Specifically, it was 
demonstrated that potentially damaging engine variables can be controlled within the constraints 
of mission thrust and mixture ratio constraints. However, the simple control scheme used in 
the proof of concept demonstration shows a slow response (the flowrates oscillate with a 
period of about 10 seconds) and a long settling time (the flowrate have not settled after 10 
seconds). To demonstrate the feasibility of the proposed engine level control strategy for a real 
life application it is necessary to demonstrate that suitable engine responses to commanded 
inputs can be achieved. Therefore, a better (faster, less overshoot) engine response is 
implemented using a multivariable controller. 

The first step in the interacting multiple input/multiple output controller development is to 
characterize the sensitivity of each controlled engine variable to each of the control valves. The 
sensitivities are determined using multiple simulation runs and the resulting data is used to 
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define a gain matrix that is implemented in the valve controller. The new valve controller is 
incorporated into the engine level controller model and a baseline control case is simulated. 

6. 1.3.1 Determination of the Gain Matrix 

The relationship between the relevant SSME variables and the control valve positions was 
determined to facilitate implementation of an interacting multiple input/multiple output 
controller. The objective of this effort is to determine the relative changes in control valve 
positions required to resolve a measured error vector. The control valves investigated are the 
OPOV, FPOV, and OPFV. The SSME variables investigated are the engine fuel flowrate, the 
engine oxidizer flowrate, the HPFT temperature, and the HPOT temperature. Additionally, 
changes in the normalized turbine temperature difference were calculated by taking the 
difference between the HPFT temperature divided by the HPFT redline temperature (1905R) 
and the HPOT temperature divided by the HPOT redline temperature (1760R) as shown below: 

T = T_HPFT/1905 - TJHPOT/1760, = Temperature Error 

The sensitivity of each SSME variable to changes in control valve positions was determined for 
control valve perturbations around a 100% RPL nominal value. Seven simulation runs were 
generated and the relevant parameter values recorded. The results of the simulations are 
summarized in Table 6-1. The first column indicates the engine variables for the nominal 
100% RPL. The remaining six columns show the engine variables for perturbations in a single 
valve position. The FPOV, OPOV, and OPFV were each perturbed by +/- 1% of the nominal 
value. Table 6-2 shows the valve to variable gains obtained by taking the difference between 
the +1% values and the -1% values. 

Based on the simulation results, the engine response linearized around 100% RPL is 
represented by: 

S = A x V, where 


dMf 

S = dMo , error vector 
dT 

175.6 149.2 1.26 
A = -428.2 2508 78.4 
6.33 -6.40 0.39 

dP.FPOV 

V = dP_OPOV , changes in valve position 
dP_OPFV 


To determine the relative changes in valve positions to resolve a measured error vector, the 
engine response equation is solved for V. 

-1 

V = A x S, where 

-1 0.005 -0.0002 0.031 

A = 0.002 0.0002 -0.053 

-0.026 0.004 1.88 
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6.1.3.2 Interacting Multiple Input/Multiple Output Controller Simulation and 
Results 

The interacting multiple input/multiple output controller simulation has the same top level 
architecture as described in Section 6.1.2 and shown in Figure 6-2a. The difference is in the 
valve controller. The superblock labeled "e2" (the valve controller) is replaced with the valve 
controller shown in Figure 6-3a. The proportional gains correspond to the gain matrix A" 1 
described in Section 6. 1.3.1. The integral gains are set to reduce the steady state error but are 
not optimized in any way. 

The input to the simulation is initially a fuel flowrate command =148 lbm/sec and an oxidizer 
flowrate command = 888 lbm/sec. At time = 1 second, a commanded step change to fuel 
flowrate command = 140 lbm/sec and oxidizer flowrate command to 840 lbm/sec is issued. At 
time = 2 seconds, a commanded step change back to the initial commanded values is issued. 
The input commands maintain a mixture ratio of 6.0 throughout the simulation and command 
the thrust from a nominal 100% RPL to about 94% RPL and back to 100% RPL. 

The simulated thrust and downthrust factor for the interacting multiple input/multiple output 
controller using the input commands described above are shown in Figure 6-3b. The engine 
thrust settles to within 1/2 of a percent in about 0.15 seconds. The downthrust factor indicates 
some overshoot, but settles to steady state in about 0.15 seconds. Figures 6-3c and 6-3d 
show the propellent flowrate responses to the step inputs. Figure 6-3e shows the turbine 
temperature to redline temperature ratio for the HPFT and the HPOT. Figure 6-3e indicates a 
maximum HPFT temperature overshoot of about 75 R during the upthrust transient. 

The interacting multiple input/multiple output controller (without gain optimization) simulation 
indicates that: 1) the HPOT and HPFT temperatures are controlled to the same value of T/R 
throughout the test, and 2) a thrust change rate of 40%/second is achieved. The interacting 
multiple input/multiple output controller simulation indicates an engine response 4 times faster 
than the current SSME which is thrust change rate limited to 10%/second. Therefore, the 
simulated controller results in an engine response that appears to exceed the requirements for a 
real life application and the feasibility of controlling the high pressure turbine temperatures 
while maintaining the thrust and mixture ratio at mission required values is demonstrated. 

6.2 Propulsion Level Controller Simulations 

6.2.1 Propulsion Level Simulation Overview and Goals 

The ICS propulsion level controller controls the thrust and mixture ratio of each engine to 
achieve overall propulsion system thrust and mixture ratio commands issued by the ICS 
controller. The goal of the ICS propulsion level controller is to implement the overall 
propulsion system thrust and mixture ratio while maximizing the reliability, life, and 
performance of the engine cluster. 

The objective of the ICS propulsion level controller simulation is to demonstrate that individual 
engine thrust values can be controlled to maximize engine cluster reliability, life, and 
performance (as indicated by the downthrust factor) within mission and engine constraints. 

The ICS propulsion level controller simulation consists of three engine models and a single 
propulsion level controller that determines the thrust of each engine. The control objectives 
implemented in the ICS propulsion level simulation are: 
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1) The overall propulsion system thrust equals the mission level controller command 

2) Individual engines are operated within an allowable operating range (65% to 109%) 

3) The individual engine downthrust factors are equal 

The first control objective is a requirement for mission completion. The second control 
objective is a requirement of the engine system. Implementation of the third control objective 
results in a thrust distribution between engines that extends the useful life of the weakest 
engine. 

The first step in the simulation effort was to define a first order engine model to facilitate 
simulation of the ICS propulsion level controller. The first order engine model provides thrust 
and downthust factor feedback to the ICS propulsion level controller. 

The ICS propulsion level controller is implemented both in MatrixX and coded for use on an 
IBM PC using the Basic language. The PC version of the simulation includes features that 
could not be readily implemented in MatrixX within the time frame of this contract 

Three simulation cases (one using MatrixX and two using the PC) are presented to demonstrate 
the functions of the ICS propulsion level controller. Then a real SSME failure case is 
simulated and the engine cluster response using the ICS propulsion level controller is 
presented. 

Finally, the detailed SSME dynamic model is integrated with the ICS propulsion level 
controller simulation in MatrixX. 

6.2.2 Definition and Characterization of First Order Engine Model 

The first order engine model is a greatly simplified model of the SSME that was used to 
provide the feedback necessary to demonstrate the propulsion level controller. Two engine 
feedbacks are required for the ICS propulsion level controller simulation, the engine thrust and 
the downthrust factor. Therefore, the first order model need only provide realistic indications 
of the thrust time response and the downthrust factor time response. 

The first order engine model approximates the SSME response to thrust commands as a first 
order response with a time constant of 0.1 seconds. For simplicity and for the clarity of 
propulsion level controller responses, higher order effects and non-linearities were not included 
in the first order engine model. The time constant of 0.1 seconds is representative of the 
response demonstrated by the detailed engine simulations described in Section 6. 1.3.2 

The first order engine model approximates the downthrust factor as a function of thrust. In 
order to define the downthrust factor equation, the downthrust factor is represented by the high 
pressure fuel turbine temperature/redline ratio. HPFT T/R it is expected to be a major 
contributor to the overall downthrust factor in any ICS. 

The downthrust factor function was quantified by forcing the detailed engine model to thrust 
values ranging from 100% RPL to 65% RPL and recording the HPFT T/R as shown in Figure 
6-4. The downthrust factor oscillations at the lower thrust levels indicate that the detailed 
engine model is being overcontrolled. The reason for the overcontrol is that the gain matrix 
was derived for the controller around 100% and the valve response is not linear. The 
downthrust factor at the lower thrust levels was estimated as the mean value for those levels. 
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The detailed engine model downthrust factor was curve fit as a function of thrust to define the 
first order engine model downthrust factor function. The data fit a linear relationship well with 
the resulting equation being given by: 

Downthrust factor = le-06 * Thrust + 0.43 [6-1] 


6.2.3 The Propulsion Level Controller Simulation 

The ICS propulsion level controller strategy is described by the MatrixX version of the 
propulsion level controller simulation shown in Figure 6-5. The superblocks labeled "ideal_2" 
are the first order engine models described in Section 6.2.2. The superblock labeled "ideal_3" 
is the first order engine model with an engine degradation simulated. Input "1" is the 
propulsion system thrust command from the mission level controller. 

In the outer control loop, the sum of engine thrusts is fed back to the ICS propulsion level 
controller and compared to the commanded propulsion level thrust to create a propulsion 
system thrust error. The engine thrusts are controlled using the propulsion system thrust error 
through a proportional-integral controller. 

The inner loop modifies the outer loop thrust commands in response to variations in the engine 
downthrust factors. The average of the engine downthrust factors is compared to individual 
engine downthrust factors to create a downthrust error for each engine. Changes in each 
engines thrust command are defined by a proportional-integral controller based on the 
downthrust errors. 

Finally, the thrust command for each engine is limited to values between 305 klbf and 512 
klbf, the normal operating range of the SSME. 

To understand the rationale for the ICS propulsion level controller strategy, an understanding 
of the downthrust factor is required. The downthrust factor represents the overall engine 
condition and is made up of multiple factors representing engine reliability, life usage, and 
performance degradation. Two types of effects contribute to the downthrust factor: 1) effects 
that are inherent to the engine operation and are related to engine thrust and mixture ratio (e.g. 
HPFT turbine speed), and 2) effects which represent a degradation or limitation of the engine 
(e.g. HPFT turbine blade cracks). Both types of effects are correlated to one of the downthrust 
factor elements, reliability for example, and contribute to the downthrust factor. Cracks in a 
the turbine blade are correlated to a reduction in the engine reliability. Decreased turbopump 
speed is correlated to an increase in turbopump reliability. The turbopump reliability is 
evaluated for the blade cracks and turbopump speed and the turbopump reliability is reflected in 
the downthrust factor. A higher reliability results in a lower downthrust factor. 

The downthrust factor control strategy is to control the individual engine thrusts so that each 
engine has the same downthrust factor. The degradation accommodation scheme achieved by 
controlling engine downthrust factors to equal values is illustrated by the following example. 
If turbine blade cracks are detected in the HPFT of engine #1, the thrust of engine #1 is 
reduced and the thrusts of engines #2 and #3 are increased. Equilibrium is reached when the 
high pressure fuel turbopump of engine #1 has reduced its speed to the point where the 
reliability of the slow turbine with cracked blades (#1) is equal to the reliability of turbopumps 
#2 and #3 operating at higher speeds. This example considers only two of the factors making 
up the downthrust factor but accurately illustrates the concept. 

The key to the downthrust error loop is the comparison to the average downthrust factor for the 
engine cluster. By comparing individual downthrust factors to the average downthrust factor 
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for the engine cluster, the sum of the individual engine thrust changes issued by the downthrust 
error loop is 0. Therefore, the propulsion system thrust control loop is not affected by the 
downthrust factor control loop 

Evaluation of the ICS propulsion level controller showed that the propulsion system thrust 
control and downthrust factor control loops worked unless an engine degradation was 
simulated and one of the engines reached its thrust operating limit. When an engine thrust 
operating limit was reached. the downthust factor control loop continued to detect a difference 
in individual engine downthrust factors and tried to modify the engine thrust commands to 
resolve the difference. Since one of the engines was unable to respond to the thrust command 
changes, the changes implemented did not add up to 0 and the propulsion system thrust level 
drifted away from the commanded value. To correct the thrust drift problem, the downthrust 
factor control loop was modified to ignore the downthrust factor if the engine thrust is at a 
thrust limit and the downthrust factor indicates the engine should be commanded beyond the 
limit. It was unclear how the downthrust factor control loop modifications could be 
implemented using MatrixX, so the simulation was coded in basic and implemented on a PC. 
The modified ICS propulsion level controller implemented on a PC is shown in Figure 6-6. 
The modifications are indicated by the inclusion of g-functions in the downthrust factor control 
loop. The g-function is defined in Figure 6-6 and is used to inhibit the downthrust factor 
control for an individual engine if that engine will be commanded beyond its thrust operating 
limit. Appendix 5 is the code of the PC version of the simulation. 

6.2.4 Demonstration Cases 

Simulations of the ICS propulsion level controller were run to demonstrate the feasibility of 
controlling individual engine thrusts to accommodate engine degradations within propulsion 
system and engine constraints. The demonstration cases run are summarized below. 

MatrixX Demonstration 

The ICS propulsion level controller simulation implemented in MatrixX and shown in Figure 
6-5 was used for demonstration case A. The timeline for case A is: 

t = 0.0 Propulsion system thrust command = 1,500,000 lbf, 

t = 2.0 Propulsion system thrust command = 1,200,000 lbf 

t = 3.0 Engine #1 downthust factor begins to ramp upward 

t = 3.25 Engine #1 downthrust factor stops ramping 

t = 4.0 Propulsion system thrust command = 1,400,000 lbf 

t = 6.0 End of simulation 

The simulation results are shown in Figure 6-7. The total thrust follows the commanded value 
throughout the test. The individual engine thrusts are identical until a degradation in engine #1 
is indicated by an increasing downthrust factor at 3.0 seconds into the test. The ICS 
propulsion level controller responds by reducing the thrust of engine #1 to accommodate the 
degradation and simultaneously increasing the thrusts for engine #2 and #3 to maintain the 
commanded propulsion system thrust. At t = 3.25 the engine degradation has stabilized and 
the engine thrusts stop changing. When the propulsion system thrust is commanded upward at 
t = 4.0, all three engines respond but engine #1, which is indicating a stabilized degradation, is 
maintained at a lower thrust than engines #2 and #3. 
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PC Demonstration - Case 1 


The ICS propulsion level controller simulation shown in Figure 6-6 was used for 
demonstration case 1. The timeline for case 1 is: 

t « 0.0 Propulsion system thrust command = 1,000,000 Ibf 

t = 1.0 Propulsion system thrust command = 1,400,000 lbf 

t = 3.0 Engine #1 downthrust factor begins to ramp upward 

t = 8.0 Propulsion system thrust command begins to ramp downward 

t = 10.0 End of simulation 

In case 1, the degradation is assumed to be a gradual loss of high pressure fuel turbine 
efficiency resulting in a steady increase in the HPFT temperature. 

Case 1 was run for three ICS propulsion level controller configurations. The first run provides 
a baseline to compare subsequent simulations against and was configured with the downthrust 
factor control loop not working. The first run implements the basic control strategy of the 
SSME, that is, all three engines are controlled to identical values. The second run has the 
downthrust factor control loop working but does not include the g-functions that inhibit engine 
commands beyond the engine thrust operating limits. The third case is with the full ICS 
propulsion level controller as shown in Figure 6-6. 

RUN 1: The simulation results are shown in Figure 6-8. The total thrust follows the 
commanded propulsion system thrust except for a lag during the propulsion system 
downthrust. All three engines show identical responses throughout the test. It would be a 
surprise if they did not since no downthrust factor control is implemented for this run. The 
downthrust factors for each engine initially are identical At t = 3.0, engine #1 begins to 
indicate a higher than normal HPFT temperature and its downthrust factor increases. The 
HPFT temperature crosses the redline at about t=5.0 and continues to increase until engine #1 
is downthrust with the others at t = 8.0. The maximum HPFT temperature indicated is about 
2150R. 

RUN 2: The simulation results are shown in Figure 6-9. The total thrust followed the 
commanded propulsion system thrust during the initial step at t = 1.0. All three engines 
indicated the same downthrust factor and have identical thrust profiles. At t = 3.0, engine #1 
begins to indicate a degradation by an increase in the downthrust factor. The controller 
responds by downthrusting engine #1 to accommodate the degradation and simultaneously 
upthrusting engines #2 and #3 to maintain the propulsion system thrust at the commanded 
value. At about t = 6.5, engines #2 and #3 reach thrust levels of 512 klbf. The thrust 
operating limit for the engines is limited to 512 klbf and engines #2 and #3 are not upthrust any 
higher. However, the downthrust factor for engine #1 continues to increase and the 
downthrust factor control loop continues to attempt to downthrust engine #1 and make up the 
loss by upthrusting engines #2 and #3. However, the commands to engines #2 and #3 are 
inhibited by the thrust limiter. Therefore, only the downthrust of engine #1 is actually 
implemented, causing the propulsion system thrust to drift away from the commanded value. 
The propulsion system thrust control loop tries to force engine #1 back to a nominal value but 
only succeeds in reducing the downthrust rate of engine #1. Beyond t = 6.5, the propulsion 
system thrust continues to drift away from the commanded value. 

RUN 3: The simulation results are shown in Figure 6-10. This run represents the fully 
implemented ICS propulsion level controller simulation. The propulsion system thrust follows 
the commanded value throughout the simulation except for a lag during the commanded 
downthrust. All three engines have the same thrust until t = 3.0 when the HPFT of engine #1 
begins to lose efficiency. Engine #1 is downthrust to accommodate the loss of HPFT 
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efficiency and engines #2 and #3 are simultaneously upthrust to maintain the propulsion system 
thrust at the commanded value. The relationship between the downthrust of engine #1 and the 
upthrust of engines #2 and #3 is such that the HPFT temperature of each engine is near the 
same value. Engine #1 continues to lose HPFT efficiency and continues to be downthrust until 
engines #2 and #3 reach their maximum operating thrust of 512 klbf. When engines #2 and #3 
are at their maximum allowable thrust, no further decrease in engine #1 thrust level is possible 
and engine #1 holds at its current thrust level. The engine #1 HPFT continues to lose 
efficiency at the same rate it has been and the HPFT temperature continues to rise. At t = 8.0, 
the propulsion system thrust is commanded to a downward ramp. The ICS propulsion level 
controller recognizes that engine #1 is indicating a higher degradation than the other engines 
and implements the entire propulsion system downthrust using engine #1 until engine #1 
reaches its lower allowable thrust limit at about t = 9.0. The downthrust of engine #1 causes a 
lower HPFT temperature and results in a decrease in the engine #1 downthrust factor. When 
engine #1 reaches its lower thrust limit, the propulsion system downthrust is implemented 
using engines #2 and #3. If the engine #1 downthrust factor had been reduced to the same 
value as the engine #2 and #3 downthrust factors, all three engines would have been 
downthrust at proportions that keep the downthrust factors equal while implementing the 
propulsion system downthrust. The maximum HPFT temperature indicated is about 1920 R, 
over 200 R cooler than case 1 without downthrust factor control. 


PC Demonstration - Case 2 

The ICS propulsion level controller simulation shown in Figure 6-6 was used for 
demonstration case 2. The timeline for case 1 is: 

t = 0.0 Propulsion system thrust command = 1,000,000 lbf 

t = 2.0 Engine #1 downthrust factor steps to 1 10% of its nominal value 

t — 1.0 Propulsion system thrust command = 1,400,000 lbf 

t = 3.0 Propulsion system thrust command = 1,100,000 lbf 

t = 4.5 Propulsion system thrust command = 1,400,000 lbf 

t = 4.6 Engine #1 downthrust factor steps to 120% of its nominal value 

t = 6.0 Engine #2 downthrust factor begins to ramp upward 

t = 8.0 Propulsion system thrust command begins to ramp downward 

In case 2, the degradation in engine #1 is assumed to be caused by a nozzle tube rupture at t = 
2.0 resulting in fuel leakage and the further nozzle tube rupturing at t = 4.6 causing greater fuel 
leakage. The degradation in engine #2 is assumed to be a gradual loss of specific impulse 
degrading the engine performance. 

The simulation results are shown in Figure 6-11. The propulsion system thrust follows the 
commanded value throughout the test. All three engines have identical thrusts until t = 2.0 
when a nozzle tube ruptures on engine #1 causing a sudden increase in the engine #1 
downthrust factor. The ICS propulsion level controller responds by downthrusting engine #1 
and upthrusting engine #2 and #3 until the downthrust factors for each engine are equal 
indicating that the degradation of engine #1 is equivalent to the engine degradation caused by 
the higher operating thrust of engines #2 and #3. When the propulsion system thrust is given a 
step downthrust command at t = 3.0, all three engines decrease their thrust in a proportion that 
keeps the individual engine downthrust factors the same. At t = 4.5, the propulsion system 
thrust is given a step upthrust command and all three engines respond. During the upthrust 
transient, more nozzle tubes rupture on engine #1 and engine #1 is downthrust. Meanwhile, 
engines #2 and #3 have reached their maximum operating thrust and the engine #1 thrust settles 
to a value that maintains the commanded propulsion system thrust. At t = 6.0, engine #2 
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begins to lose specific impulse causing the engine #2 downthrust factor to increase. Initially, 
the ICS propulsion level controller takes no action since the engine #2 thrust cannot be 
decreased within the constraints of the propulsion system thrust command unless the engine #1 
thrust is increased (engine #3 is at its upper thrust limit) and engine #1 is indicating greater 
problems than engine #2 (i.e. a greater downthrust factor). When the engine #2 downthrust 
factor exceeds the engine #1 downthrust factor, the propulsion level controller acknowledges 
that engine #2 has degraded as much as engine #l.and begins to trade engine #1 thrust for 
engine #2 thrust in proportion to make the downthrust factors equal. At t = 8.0 when the 
propulsion system thrust is commanded to ramp downward, engine #2 (which continues to 
degrade) continues to be downthrust, though at a slighdy higher rate since the downthrust is no 
longer forcing engine #1 to higher thrust levels. Engine #1 is held at a constant thrust level. 
Engine #2 continues to be downthrust until it reaches its lower thrust limit and then the 
propulsion level controller begins to downthrust engine #1 to maintain the commanded 
propulsion system thrust. 

Summary 

The ICS propulsion level controller commands the individual engine thrusts to values that 
minimize the maximum downthrust factor while maintaining the commanded propulsion 
system thrust and keeping each engine within its safe operating thrust range. 


6.2.5 Simulation of an SSME Failure Case 

The feasibility of the ICS propulsion level controller strategy was demonstrated by the 
demonstration cases described in Section 6.2.4. To further demonstrate the utility of the ICS 
propulsion level controller, an SSME failure is simulated. The failure summary is taken from 
the S AFD phase I report 

Test 902-249: During stable operation at 109% of rated power level the test shut down 
prematurely due to a HPFTP accelerometer redline and associated massive failure of the HPFT 
first stage turbine blade. The sequence of events leading to the blade failure follows: 

1. Initial turbine damage at t = 3.0 seconds. The FPB injectors non-uniform flow condition 
experienced in at least two previous tests may have persisted (despite rework) and worsened. 

2. Engine fuel inlet temperature increases and the high pressure fuel pump begins to cavitate at 
t = 108 seconds. The temperature increase was brought about by a propellent transfer. The 
increased temperature lowers the fuel density causing an increase in the HPFP volumetric 
flowrate, speed, and power necessary to hold thrust constant. As the flow and speed increase, 
the HPFP approaches the conditions at which the suction capability of the hardware is 
exceeded and cavitation starts. Once cavitation is initiated, the efficiency of the pump 
degrades, causing the HPFTP speed to increase to maintain the fuel pump output to hold thrust 
constant, causing worsening cavitation conditions and causing an increase in the HPFT 
temperature. 

3. A Kel-F rub ring flexes and melts at t = 374 seconds. The released Kel-F particles plug 
nozzle tubes causing them to rupture, contributing to the HPFT temperature increase. 

4. The first stage turbine blade fails at t = 450.52 seconds. 

Post firing inspection of the facility and engine revealed severe damage to the main combustion 
chamber including the injector and sidewalls, extensive bumthrough damage to the nozzle. 
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substantial damage to the HPFIP first and second stage turbines, and an approximately 12 inch 
long section of the HPFP inlet volute missing. 

For the simulation, a typical STS flight thrust profile is used as the propulsion system thrust 
command. The failure is assumed to happen at the same time as the failure that occured during 
test 902-249. The downthrust factor is assumed to follow a linear estimation of the HPFT 
temperature recorded during the test and shown in Figure 6-12. 

The results of the simulation are shown in Figure 6-13. The individual thrust profiles using the 
ICS propulsion level controller are identical to the thrust profiles that would be expected with 
the current SSME controller until the HPFT temperature starts to rise. The current SSME 
controller would have held the engine at a constant thrust until the propulsion system thrust 
command was changed at about 460 seconds. The ICS propulsion level controller begins to 
reduce the degraded engine thrust at about 325 seconds and continues to reduce it until the 
other two engines reach the upper thrust limit of 512 klbf. At the time of failure, 450 seconds 
into the flight, the ICS propulsion level controller has reduced the degraded engine thrust to 
slightly under 94% of the rated power level whereas the current SSME controller would have 
maintained the engine at its nominal 104% thrust level. At 460 seconds, when the propulsion 
system thrust command is ramped down, the ICS propulsion level controller implements the 
entire downthrust using the degraded engine resulting in a rapid decrease in thrust level until 
the degraded engine reaches its lower thrust limit at 65% of RPL. Downthrusting the engine is 
clearly the correct response to the anomaly since downthrusting the engine reduces the output 
demanded of the HPFP. The HPFP speed decreases and reduces cavitation in the pump. 
Whether or not the downthrust is sufficient to have averted the failure is impossible to say. 
However, if the engine had still failed it would have failed at a reduced power level. 

6.3 ICS Simulation Conclusions 

The ICS simulations demonstrate that individual engine parameters can be controlled to reduce 
engine operating stresses within the constraints imposed by mission requirements (thrust and 
mixture ratio). Furthermore, the simulations demonstrate the capability to control an engine 
cluster to extend the propulsion system life using a calculated engine health parameter. 
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dMf 

dMo 

dT 

Change in 
Fuel Flowrate 

Change in 
Oxidizer 
Flowrate 

Change in 
Temperature 
Error 

1 

1 

2.74 

-6.68 

0.0519 

dP_FPOV 

Change in 
FPOV Position 

0.0156 

0.0156 

0.0156 

1 

1 

1.91 

32.1 

-0.0435 

dP_OPOV 

Change in 
OPOV Position 

0.0128 

0.0128 

0.0128 

1 

1 

0.0162 

1 .0036 

0.005 

dP_OPFV 

Change in 
OPFV Position 

0.0128 

0.0128 

0.0128 


Table 6-2 Relationship Between Control Valves and Controlled 
Parameters 
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Figure 6-1 Overview of ICS Engine Level Simulation 
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Figure 6-3b Engine Thrust and Downthrust Factor Responses to Step Inputs 
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Figure 6-3e HPFT and HPOT Temperature/Redline Ratio response to Step Inputs 
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Figure 6-4 Downthrust Factor Characterization 
- Detailed Engine Model Results 
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Figure 6-8 ICS Propulsion Level Controller Simulation 
Case 1, w/o Downthrust Factor Control 
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Figure 6-9 ICS Propulsion Level Controller Simulation 
Case 1, Downthrust Factor Control w/o gn Function 
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Figure 6-10 ICS Propulsion Level Simulation 
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Figure 6-11 ICS Propulsion Level Simulation 

Case 2 
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SECTION 7 ICS ADVANCED FUNCTIONAL FRAMEWORK 

The ICS advanced functional framework represents a control system that fully integrates the 
ICS control objectives of 1) maximum reliability, 2) minimum maintenance, and 3) maximum 
efficiency. The thrust and mixture ratio of each engine are controlled to meet the propulsion 
system thrust and mixture ratio requirements by a propulsion level controller. Individual 
engine control is limited to implementing the propulsion system commands in the manner that 
maximizes individual engine performance, efficiency, and life and includes feedback to the 
propulsion level. The propulsion system is controlled as an integrated system, rather than as a 
collection of individual engines (the approach used in current rocket engine propulsion 
systems). The integrated propulsion system is expected to increase the overall propulsion 
system reliability, performance, and useful life by enabling tradeoffs between individual 
engines and thereby mitigating the effects of the "weak link" in the system. 

The proposed advanced functional framework is shown in Figure 7-1. The controller consists 
of a mission level controller that defines the requirements of the propulsion system, a 
propulsion level controller that coordinates implementation of the propulsion system 
requirements, and an engine level controller, for each engine, that implements the engine 
requirements in the most favorable manner for that engine. The mission level controller 
evaluates the requirements for mission completion and issues overall propulsion system thrust 
and mixture ratio commands. The propulsion level controller evaluates the propulsion system 
thrust and mixture ratio commands and controls each engine thrust and mixture ratio to 
implement the propulsion system thrust and mixture ratio. The distribution of thrust and 
mixture ratio between individual engines is determined based on the health, efficiency, and 
remaining life of each engine. The engine level controller implements the thrust and mixture 
ratio commands from the propulsion level controller by issuing position commands to the 
engine valves. Since only two engine variables are controlled to "hard" values, and seven 
control valves are available on the proposed engine configuration, multiple sets of valve 
commands result in implementation of the "hard" variables (thrust and mixture ratio). The 
engine level controller evaluates the sets of valve commands that can implement the 
commanded engine thrust and mixture ratio and selects the set that minimizes the cost to the 
engine. Unless otherwise specified, cost is defined in terms of engine wear, risk of engine 
failure, and performance losses. 

The advanced functional framework is made up of two types of functions: 1) controller 
adaptation functions and 2) real time control loop functions. The real time control loop 
functions are implemented during every major cycle of the controller. The real time control 
loop functions implement and maintain the propulsion system thrust and mixture ratio 
according to the commands from the mission level controller. The controller adaptation 
functions modify parameters within the real time control loop to optimize control of the 
propulsion system in response to existing or predicted conditions that exist within the engine 
subsystems. Definitions of each functional element in the framework are provided below. 

7.1 Controller Adaptation Functions 

The controller adaptation functions are non-real time functions that evaluate engine conditions 
and modify the response of the real time control functions to optimize control of the propulsion 
system. The timing of the controller adaptation functions is not constant. The controller 
adaptation functions evaluate critical conditions on an interrupt basis and can quickly modify 
the real time control loop in response to a sudden engine degradation. Non mission critical 
conditions are evaluated at a slower rate. For example, during normal engine operation the 
remaining life of multiple turbopump components may be inferred from engine measurements 
and the real time control loop modified to reflect the new remaining life values every so often. 
However, if the HPFT temperature suddenly increases, the remaining life calculations are put 
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on hold and the real time control loop is immediately modified to accommodate the temperature 
rise. Once the temperature accommodation is implemented, the remaining life calculations are 
resumed. 

Each of the controller adaptation functions and their supporting functions are described in the 
following sections. 

Estimate Remaining Life_of Critical Components 

The purpose of this function is to estimate the remaining life of engine components. Four 
approaches to estimate component remaining life are proposed. They are: 1) direct 
measurement of remaining life, 2) direct measurement of life used, 3) estimation of damage 
accumulation based on detailed damage models, and 4) estimation of damage accumulation 
based on empirical data. The prefered method, where possible, is to directly measure the 
remaining life of a component, for example measuring the wall thickness of the MCC coolant 
channels. The second approach considered is to directly measure the damage that has occured 
in a particular component. An example of direct damage measurement is to measure the radial 
displacement of a turbopump shaft to infer the amount of turbopump bearing wear. If no direct 
measurements are available, the next approach tried is to estimate the remaining life of a 
component based on the accumulated damage predicted by a detailed damage model using real 
time engine measurements (temperatures, pressures, vibrations, etc.). Finally, if there are no 
direct measurements and no damage model available, the remaining life of a component is 
estimated based on the number of engine starts, time at each power level, etc. The output of 
this function is an estimate of the remaining life and a standard deviation reflecting the certainty 
in the estimate for each specific component evaluated. 

En gine Diagnostics 

The purpose of this function is to identify specific conditions that exist within the engine. 
Examples of diagnostic capabilities include the identification of cracked turbine blades, failure 
of turbopump bearings, sensor failures, and nozzle fuel leaks. The technique used to identify 
each condition is specific to the condition being evaluated. The output of this function is a 
probability distribution for the magnitude of a specific condition if applicable, or the probability 
that a condition has been identified if there is no magnitude associated with the condition. For 
example, the output for a fuel leak would be the probability distribution that a specific 
magnitude fuel leak exists. The output for a sensor failure would be the probability that the 
sensor reading is correct 

Define Weighting Factors 

The purpose of this function is to assign weights to critical engine parameters. Critical engine 
parameters include the high pressure turbine temperatures, turbopump vibrations, MCC 
temperatures, and the high pressure pump net pump suction heads. Engine parameters also 
include transient parameters such as changes in a high pressure turbine temperature. The 
probable remaining life of critical components and likely engine conditions are evaluated to 
define weights to each parameter. The parameter weights reflect the combination of all factors 
associated with that parameter and take into account both the severity and likelihood of each 
factor. As an example, a turbopump bearing with a high probability of little remaining life and 
a pump operating near its suction limit (where cavitation begins) both indicate that the weight 
associated with turbopump speed should be increased. The output of this function is a 
numerical value representing the weight associated with each engine parameter considered by 
the weighted cost calculation in the real time control loop. 
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Valve/Actuator Models 


The valve/actuator models are dynamic models of each valve response. Engine valve 
commands issued by the real time control loop and the pressure drop across each valve are 
used as inputs to the valve models. The output of each model is the predicted time dependent 
position of each valve. 

Valve / Ac tuator Diagnostics 

The purpose of the this function is to identify valves/actuators that have failed or that are likely 
to fail. The valve/actuator diagnostics compare the valve position predicted by the 
valve/actuator models with the positions indicated by engine sensors. Disagreements between 
the two position indications are evaluated to determine the health/availability of each valve. The 
output of this function is the probability of failure for each control valve. 

Estimate Mo del Parameters 

The purpose of this function is characterization of the engine operating state to anchor the 
engine model used in the real time control loop. Characterization includes the estimated 
efficiency of each high pressure turbine and each high pressure pump. Characterization also 
includes specific engine conditions which can change the effect of the control valves on the 
engine. For example, a nozzle fuel leak would cause the high pressure turbines to run 
abnormally hot and changes in the prebumer oxidizer valve position would result in a greater 
temperature increase than normally expected. The output of this function is a numerical value 
for each model element characterized. 

Propulsion System Diagnostics 

The purpose of this function is to evaluate the condition of each engine and estimate the 
probability that the propulsion system is able to implement the overall thrust and mixture ratio 
required for mission completion or abort modes. The mission requirements (e.g. maximum 
thrust required for the flight profile, remaining mission time) are sent to the propulsion system 
diagnostics function by the mission controller for the current mission and possible abort 
modes. The propulsion system diagnostics evaluate the condition of each engine and estimates 
the probability that the propulsion system will be able to implement the mission requirements 
without a catastrophic failure in the propulsion system. The output of this function is a 
probability of success for the current mission and each abort mode possible. The mission level 
controller uses the success probabilities for the propulsion system (and those for other major 
subsystems) to evaluate the current mission and abort modes and decide on the course of action 
that has the highest likely payoff. 

Determine Allowable Engine Thrust and Mixtur e Ratio Ranges 

The purpose of this function is to determine the thrust and mixture ratio ranges that can be 
implemented by each engine. The allowable ranges are determined by the availability of engine 
control valves to implement changes. For example, if an engines FPOV fails, the thrust and 
mixture ratio changes that can be implemented are severely limited. The output of this function 
is a range of allowable engine thrusts and mixture ratios. An example of the output thrust 
range for an individual engine is shown Figure 7-2. The solid line indicates the range for a 
nominal engine and the dashed line represents the allowable range for an engine with a failed 
actuator. 
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Determine Weighted Engine Thrust and Mixture Ratio Ranees Based on. Engine Con dition 

The purpose of this function is to estimate the cost associated with operating the engine at each 
thrust or mixture ratio in its allowable range. Cost for this function is defined in terms of the 
risk of engine failure during the mission. In all cases, the cost of operating an engine is greater 
at higher thrust levels. Higher thrust levels result in higher failure risk in almost all cases. In 
addition to the nominal cost associated with each thrust and mixture ratio, specific engine 
conditions are evaluated to modify the "cost distribution" for each engine. For example, the 
cost of operating an engine at a given thrust with a degraded turbopump bearing is higher than 
the cost of operating a nominal engine at the same thrust. The probability and magnitude of 
specific engine conditions are used to define the likely cost at each thrust and mixture ratio. 
The output of this function is the cost associated with operating each engine at specific thrust 
and mixture ratios. Figure 7-3 shows the cost for an individual engine as a function of engine 
thrust if the cost distribution is linear. The solid line represents a nominal engine and the 
dashed line represents a degraded engine. Engine degradations are expected to increase the 
slope and height of the cost distribution. 

Modify Weighted Engine Thrust and Mixture Ratio Ranges Based on Engine Efficiency 

The purpose of this function is to modify the weighted engine thrust and mixture ratio ranges 
based on the cost associated with performance losses. Nominally, the engine performance is 
greatest at the rated thrust and drops off to either side. Engine performance also peaks at a 
specific mixture ratio and drops off to either side. Depending on the engine design, the 
nominal mixture ratio may not be the mixture ratio at which the highest engine performance is 
achieved. In addition to the nominal cost distribution, engine performance parameters (e.g. 
HPOP efficiency) are evaluated to determine the performance of each specific engine relative to 
a nominal engine. Changes in engine performance parameters are expected to effect the overall 
height of the cost distribution. Figure 7-4 shows the linear cost distribution from the weighted 
engine thrust example used in the previous example modified to reflect the cost associated with 
engine efficiency. The solid line is a nominal engine and the dashed tine represents a less 
efficient engine. 

Modify Weighted Engine Thrust and Mixture Ratio Ranges Based on Remaining Engine Life 

The purpose of this function is to modify the weighted engine thrust and mixture ratio ranges 
based on the cost associated with remaining engine life. The cost, in terms of engine life, to 
operating an engine is greater at higher thrust and mixture ratios. The nominal cost distribution 
is modified by the estimated remaining engine component life probabilities. An engine that 
indicates tittle remaining life has a higher cost to operate than a nominal engine. Differences in 
remaining engine life change the slope and the height of the cost distribution. Figure 7-5 
shows the linear cost distribution used in the previous example modified to reflect the 
remaining life of the engine. The output of this function is the total cost for operating each 
engine at specific thrust and mixture ratios. 

7.2 Real Time Control Loop Functions 

The real time control loop functions are the functions that produce outputs during every major 
cycle of the control system. These functions are responsible for achieving and maintaining the 
propulsion system thrust and mixture ratio at the values commanded by the mission 
coordinator. The real time control functions at the individual engine level evaluate the engine 
status and implement the propulsion level controller commands with the lowest cost to the 
individual engines. Additionally, the real time control loop functions initiate changes in the 
individual engine states in response to engine conditions. 
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Thrust and M ixture Ratio Estimator 

The purpose of this function is to evaluate engine measurements and provide an estimate of the 
engine thrust and mixture ratio. 

Issue Lowest Cost Set of Engine Thr u sts and Mixture Ratios to Individual Engin& s 

The purpose of this function is to evaluate errors in the propulsion level thrust and mixture ratio 
and issue thrust and mixture ratio command to each engine. The propulsion level controller 
distributes the thrust and mixture ratio between individual engines to minimize the maximum 
individual engine cost Minimizing the maximum individual engine cost is proposed since the 
engine cluster is limited in life, reliability, and performance by its weakest member. Figure 7-6 
shows conceptually how this function operates. The total cost distribution for three engines is 
shown. Engine #2 represents a nominal engine, engine #1 is degraded, and engine #3 has a 
failed control valve. If the measured thrust is lower than the commanded thrust the propulsion 
level controller issues an upthrust command. The thrust commands to individual engines reflect 
the associated cost for each engine. In the example shown in Figure 7-6, engine #2 is 
commanded to its maximum operating thrust and the remainder of the thrust error is corrected 
by engines #1 and #3 with engine #1 making up the majority of the error. Conceptually, the 
propulsion level controller moves the command line (dashed line in the Figure 7-6) up and 
down in response to measured propulsion system thrust errors. 

If the cost distribution for an individual engine changes, the thrust command for that engine is 
changed which results in a propulsion system thrust error and the command line is adjusted to 
resolve the error. For example, take the case when all three engines are initially operating 
nominally and engine #2 suddenly develops a nozzle leak. The slope and height of engine #2s 
cost distribution suddenly increase changing the point at which engine #2s cost distribution 
crosses the command line. Engine #2 is downthrust causing an error in the propulsion system 
thrust. The command line is moved upward upthrusting all three engines until a new 
equilibrium is reached in which engines #1 and #3 are now operating at higher thrusts than 
engine #2 but the propulsion system thrust is at its original value. 

Determine Possible Solutions 

The purpose of this function is to determine the set of valve commands that implement the 
thrust and mixture ratio commands received from the propulsion level controller. The only 
external commands to the engine system are thrust and mixture ratio. Since seven control 
valves are used in the proposed system, multiple combinations of valve position changes are 
available to resolve the thrust and mixture ratio errors. The status of each valve/actuator is used 
to determine which valve position changes can be implemented. If the FPOV has failed and is 
locked in position, no combinations requiring a change in FPOV position will be output. The 
output of this function is the set of valve position commands that can be implemented to resolve 
the thrust and mixture ratio errors. Figure 7-7 shows an example of the data content of this 
functions output. 

Estimate Engine Parameters for Each Solution 

The purpose of this function is to estimate engine parameters expected to result from the 
implementation of each combination of valve position commands identified as possible 
solutions. Engine parameters are estimated for each possible solution by inputing the valve 
position commands to an engine model. The engine model is kept current with engine 
measurements and parameters estimated by the controller adaptation functions. The output of 
this function is a set of engine parameters for each combination of valve commands identified 
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as possible solutions. Figure 7-8 shows an example of the data content of this functions 
output. 

Calculate Weighted Cost of Each Solution 

The purpose of this function is to estimate the cost associated with implementing each set of 
valve commands identified as possible solutions. The weighted cost associated with each 
solution is determined by calculating the sum of the engine parameters multiplied by their 
weighting factors. The cost of a solution will change depending on engine conditions and 
remaining life. If an engine failure occurs and the parameter weighting factors change, a set of 
valve position commands different than the current set of valve positions may have the lowest 
cost. In this case the new valve commands will be implemented, changing the engine state but 
not affecting the engine thrust or mixture ratio. This function is shown conceptually in Figure 
7-9. 

Implement Solution W ith Lowest Cost 

The purpose of this function is to implement the set of valve position commands that represents 
the lowest cost to the engine. In the example shown in Figures 7-7 to 7-9, solution #4 would 
be implemented. 

7.3 Advanced Functional Framework Conclusions 

The proposed framework is computationally intensive, but provides an integrated set of 
propulsion system functions that optimize propulsion system performance, increase 
propulsion system reliability, and extend the useful life of the propulsion system. The 
functions proposed enable the propulsion system controller to continuously evaluate individual 
engine statuses and implement the mission required thrust and mixture ratio commands in the 
manner that optimizes propulsion system life, reliability, and performance. 
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Figure 7-1 ICS Advanced Functional Framework 
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Figure 7-2 Allowable Thrust Range 



Figure 7-3 Weighted Engine Thrust 



Figure 7-4 Engine Efficiency Modification To Weighted Engine Thrust 



Figure 7-5 Remaining Engine Life Modification to Weighted Engine Thrust 
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Solution ID 

MFV 
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FPOV 

OPOV 

ccv 

F7V 

LPOTV 

1 

+ 0.01 

- 0.03 

+ 0.01 

- 0.02 

+ 0.135 

- 0.003 

- 0.013 

2 

- 0.013 

+ 0.001 

- 0.003 

+ 0.001 

+ 0.001 

+ 0.01 

+ 0.135 

3 

+ 0.01 

- 0.02 

+ 0.034 

+ 0.01 

+ 0.034 

- 0.03 

+ 0.01 

4 

0.0 

+ 0.001 

- 0.005 

- 0.003 

+ 0.001 

- 0.002 

+ 0.001 

5 

- 0.002 

+ 0.001 

- 0.03 

+ 0.135 

+ 0.001 

0.0 

+ 0.001 


Figure 7-7 Possible Solutions 
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Figure 7-8 Estimated Engine Parameters 
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Figure 7-9 Weighted Cost of Each Solution 
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Appendix 1 

SSME Start Transient Simulation Results 
Nominal Case 
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1 1/ 5/90 4 
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PRESSURE - PS I A 


APPENDIX 1 


MCC COMBUSTION CHAMBER PRESSURE 11/5/90 5 

■PCIE ST331 ATPUTM BASE START ROW (RKD) 4/90 
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Appendix 2 

SSME Start Transient Simulation Results 
FPOV 1st Notch @ 0.60 seconds 
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FUEL PREBU9® PRESSURE 10/ 5/flO 3 

■PFP S738I ATPDTM FPOV 1ST M3TCH . 60 (START RIN) (RKD) 5/90 
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TEMPERATURE - CtEo. R II MIXTURE-RATIO 


APPENDIX 2 


OXIDIZER PREBURNER MIXTURE RATIO , 0 / 5 /*) IS 

EMROPM ST38I ATPOTM FPOV 1ST MJTCH .60 (START RUN) (FKD) 5/90 



TEMPERATURE OXDIZER PREEURNER , 0 / 2 

TCP ST281 ATPOTM FPOV I ST NOTCH .60 (START RUT) (RKD) 5/90 



RI/RD91-158 






APPENDIX 2 



RI/RD9I-158 



APPENDIX 2 




RI/RD91-158 




Appendix 3 

SSME Start Transient Simulation Results 
FPOV 1st Notch @ 0.75 seconds 
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Appendix 4 

Listing of SSME Start Transient Control Actions 



Step 


A ctio n 


Update Engine Status Word to Start Initia 
tion mode of Start phase. 


2 

3 


Limit OPOV command to 70% and FPOV com 
mand to 56.1%. Set initial OPOV Delta 
Power Level to 9.65517%. NOTE - For FRT limit 
OPOV command to a constant 100% throughout 
qTART/MATNSTAGE. 


Reset TIME REFERENCE to Zero. 

Initial conditions of propellant and 
pneumatic valves assumed per ending status 
of Start Preparation phase (except for engine 
Fuel Purge). Energize all igniters. 


Set MCC Pressure Reference at 731 psia. 

De-energize Fuel System Purge Control Valve 
Channel A and Channel B. 


6 


7 


8 


nitiate Shutdown Limit Monitoring for HPOP 
ntarmediate Seal Purge, and HPOT Secondary 
;eal Cavity Pressures. 


Initiate Sensor Qualification Monitoring 
for HPOT Turbine Discharge Temperature. 
Initiate Shutdown Limit Monitoring 
for Preburner S/D Purge Pressures. 


Ramp MFV to 100% actuator position 
at 150 %/second actuator rate. 


Set Sequence for Shutdown from Start. 

(a) Set FPOV shutdown compare position No. 3 
to 43% open. 

(b) Set FPOV shutdown actuator rate No. 2 
to 14 %/second. 


Time 

(seconds) 

0 
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Action 


Time 

(seconds) 


(Continued) 

(c) Set OPOV shutdown actuator rate No. 3 
to 70%/second. 

(d) Set OPOV shutdown actuator rate (effective 
at Shu tdown+1 . 42 sec) to 70%/sec. 

(e) Set Preburner Shutdown purge ON time 
equation to accommodate time = 2.2 
sec at RPL and time = 1.8 sec at 65% 

RPL. 

Ramp MOV to 59.3% actuator position 

at 60%/sec actuator rate. 

Ramp FPOV to 30% actuator position 
at 200%/sec actuator rate. 


Ramp OPOV to 30% actuator position at 
200%/second actuator rate. 


Ramp FPOV to 56.1% actuator position 
at 200%/sec actuator rate. 

Ramp OPOV to 48.0% actuator position at 
20.0%/sec actuator rate. 

Ramp FPOV to 47.0% actuator position at 
200%/sec actuator rate. 

Change FPOV and OPOV ramp races to 100 
percent per second and 100 percent 
per second respectively. 

Initiate closed-loop MCC Pressure control 
(proportional error control only). In addition 
continue to completion the OPST schedule. 

Initial value of propor- 
tional error control 
gain = 0.01444 

percent/psia 


0.10 

0.12 

0.26 

0.28 

0.68 

0.74 

1 74 
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Time 



Step 

18 

19 

20 
21 
22 

23 

24 

25 

26 
26a 

27 

28 

29 

29a 



Ramp MCC Pressure reference to 406 psia at 
8.0 psi/20 msec. 

Set FPOV crossfeed gain to 0.4596% per % 
and ramp to 1.15% per % at 0.5676% per % per 
second. In addition continue to completion 
the FPST schedule. 

Ramp FPOV to 51.5 percent actuator position 
at 200 percent per second actuator rate. 

Ramp OPOV to 38.5 percent actuator position 
at 200 percent per second actuator rate. 

Ramp FPOV to 49.0 percent actuator position 
at 200 percent per second actuator rate. 

Check 1IPFP Shaft Speed within limits for 
ignition confirmation. 

Ramp CCV to 70 percent actuator position 
at 100 percent per second. 

Ramp OPOV to 38.5 percent actuator 
position at 200 percent per second actuator 
cate . 

Ramp FPOV to 54.6 percent actuator position 
at 200 percent per second actuator rate. 

Verify Main Combustion Chamber Pressure is 
within ignition confirm limits. 

Ramp OPOV to 48.5 percent actuator position 
at 200 percent per second actuator rate. 

Initiate channel qualification monitoring 
of MCC Pressure as a function of Pc 
Reference Value. 

Monitor for DCU switchover or PFI/PRI 
sequence for Anri flood valve monitoring 
delay. 

Latest time to perform Shutdown Limit 
Monitoring on Preburner Shutdown Purge 
Pressures . 


0.80 

0.88 
1.10 
1.16 
1.24 
1 . 46 
1.50 

1.68 

1.70 

2.10 

2.26 

2.28 
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Action 


Time 

(seconds^ 


Verify Main Combustion Chamber Pressure is 
within limits and Antiflood Valve is open 
for ignition confirmation. 

Initiate Shutdown Limit Monitoring of 
HPOT Turbine Discharge Temperature 
Upper Limit. 

Change FPOV command limit to 102%. 

Retain OPOV command limit 70%. 

Terminate monitoring for DCU switchover 
or PFI/PRI sequence. 

Set Backup DCU ignition confirmation 
for MCC Pc and AFV. 

Ramp OPOV to 49.1 percent actuator position 
and change OPOV ramp rate limit to 100% 
per second. 

Ramp FPOV to 56.05 percent actuator position 
and change FPOV ramp rate limit to 100% per 
second. 

Switch to Mainstage gain value of proportional 
error control and activate iivtegral error 
control for MCC Pressure. 

_ * 7 

Activate POGO Precharge Control Valve Channel 
A and Channel B 


Step MCC Pressure reference to 737 psia, 
then ramp MCC Pressure reference to command 
level at 34.46 psi/20 msec rate. 

De-energize all igniters. 

Ramp MOV to 100% actuator position at 
31.50%/sec actuator rate. 

Ramp CCV to 52% actuator position at 
45.0%/second actuator rate. 

Update Engine Status Word to indicate 
Thrust Buildup mode, if Hydraulic 
or Electrical Lockup not in effect. 


2.30 


2.40 


0 , 11-0 


2.42 
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Action 


Time 

(seconds) 


Terminate channel qualification monitoring 
of MCC Pressure as a function of Pc Reference 
value . 

Initiate channel "band test” qualification 
monitoring of MCC Pressure as a function of 
Pc Reference value. 

Initiate scheduled operation of CCV as a 
function of MCC Pressure Reference (CCV = 

52% at 50% RPL; CCV = 100% at RPL) 

Initiate Fuel Flowrate individual sensor 
qualification tests and inter-channel test 

Initiate OPOV command limiting as a function 
of Pc Reference. 

Initiate closed-loop mixture ratio control 
(proportional plus integral controls 

Initiate both MCF Limit monitoring 

and Lower Shutdown Limit monitoring for HPOT 

Turbine Discharge Temperature 

De-activate POGO Precharge Control Valve 
Channel A and Channel B 

Verify POGO Preciiarge pressure is within 
limi ts. 

Last time to monitor POGO Precharge 
pressure. 

Reinitialize control-loop integrators to 
zero as required. Reinitialize OPST and 
FPST so that OPOV command and FPOV command 
remain unchanged by reinitialization. 

Set Mainstage Pc Reference Rate Limit to 
6 psi/20 msec. Set maximum rate limits for 
FPOV and OPOV total valve command positions 
to 200%/second. 

Initiate scheduled operation of MOV as a 
function of MCC Pressure Reference. (MOV = 
100% at 50% RPL; MOV = 100% at RPL). 

Initiate scheduled operation of MFV as a 
function of MCC Pressure Reference. (MFV = 
100% at 50% RPL; MFV = 100% at RPL.) 


2.30 

3.50 

3.60 

u 

3.30 

4.40 

4.94 

4.98 
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Time 

(seconds! 


Step 

56 


57 


58 

59 


60 


Action 

Set Sequence for Shutdown from Mains tage 

(a) Set FPOV Shutdown compare position No. 3 
to 40% open. 

(b) Set FPOV Shutdown actuator rate No. '2 to 
18%/second. 

(c) Set OPOV Shutdown actuator rate No. 3 to 
30%/second. 

(d) Set OPOV Shutdown actuator rate (effective 
at Shutdown + 1.42 sec) to 200%/second. 

(e) Set Preburner Shutdown Purge ON time 
equation to accommodate time = 1.8 sec at 
RPL and at 65% RPL (i.e., zero slope). 


Change engine phase of Engine Status 
Word to Mainstage. If in Hydraulic 
Lockup, Electrical Lockup, or Fixed 
Density then report the corresponding 
mode in the Engine Status Word, else 
report Normal Control in the Engine 
Status Word. 

Change crossfeed gain schedule. 

Discontinue "band test" and initiate 
"delta test" to qualify MCC Pressure 
channels as a function of Pc Reference 
value . 

Initiate monitor for OPOV position. 


Initiate both Sensor Qualification and 
Shutdown Limit Monitoring for HPFT. TDT, 

HPFP Coolant Liner Pressure, and MCC Pc. 

Terminate monitor for maximum OPOV position. 

Calculate OPOV Delta Pouer Level using the 
maximum OPOV position observed between 
and 5.5 seconds. Use OPOV Delta Power Level 
and Pc Reference to determine a dynamic OPO 
Command Limit each Major Cycle. 


5.00 


5.02 

5.04 

5.5 
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Appendix 5 

ICS Propulsion Level Simulation 
BASIC code listing 



' ics propulsion level simulation, icsp9 


.screen 1 
iedlsO 
ied2=0 
ied3=0 
iet=0 

’ define output file 

open ,, icsp2.out M for output as 1 

tmax=10 

dts-02 

for t=0 to tmax step dt 

♦ Input Parameters 

' thrust command 
tc=1000000 

if t>l then tc=140000C 

if t > 3 then tc=110000G 

if t > 4 . 5 then tc=140000C 

if t >8 then tc=140G00G- ( t-c ' *1000CC 

’ aownthrust deviations 


dl=dla 

d2=d2a 

d2=:d3a 

if t>2 then dl=i . l*dla 

if t>4.6 then dl=1.2*dl& 

if t>6 then d2=d2a*{ i-< t-6 j /5*C .8 : 

' engine models * 

d£la=( fl-fla) /Q. 1 
f la=f la+df la*dt 
dla=0 . 000001 * f la+G . 43 

df 2a= ( f 2-f 2a ) /0 . 1 
£2a=£2a+d£2a*dt 
d2a=0 . 000001 * £2a+0 . 43 

df 3a={ f 3-f3a) /0 . 1 
£3a=£3a+d£3a*dt 
d3a=0 . 000001*£3a+0 . 43 


' — — — controller-^ — — ' 

kO=l: "Thrust Error Proportional Gain 
kl=5: 'Thrust Error Integral Gain 
k.2=10G000: ’Down thrust Factor Proportional Gain 
113=5000000: 'Downthrust Factor Integral Gain 

da=(dl+d2+d3)/3 


gl=l 

g2=l 

g3=l 

if £1< 305001 then if dl-da>0 then gl=0 

if £1> 511999 then if dl^da<0 then gl=0 

if £2 <305001 then if d2-da>0 then g2=0 

if £2 >511999 then if d2-da<0 then g2=0 

if f3<305001 then if d3-da>0 then g3=0 

if f3> 511999 then if d3-da<0 then g3=0 

if gl+g2+g3=0 then edl =0 : ed2=G : ed3=G : goto 10 

da= ( gl*dl+g2*d2+g3*d3 ) / { gl+g2+g3 ) 

edl=gl*(dl-da) 

ed2=g2* ( d2-da } 

ed3=g3* (d3-da ) 


10 ' 

et=tc-£ la-f 2a-f 3a 

£edl=iedl~ ( k3*edl ) *dt 
i ed2= i ed2- { 1:3 * ad2 ; *dt 
ied3=iec3- { k3“ed3 } *dt 
iet=iet-*- ( Vi 1 * 9 1 ; *dt 


f l=iet-+*kQ*et-iedl-l:2*edl 
£2=iet-*-k0*et-i9d2-k2*ed2 
£ 2 = i e t > 1:0 * e n - 1 ed3 - h2 * ed3 


if £i< 305000 then £1=305000 
if £1 >512000 then £1=512000 
if £2< 305000 then £2=305000 
if £2> 512000 then f 2=5 12000 
if £3 < 305000 then £3=305000 
if £3 >512000 then £3=512000 
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screen output 


locate 1 , 1: print int(£la) ;int(£2a) ;int(£3a) ; int(£la+£2a+£3a) ,int(1000*d2)/1000 

ptc=tc/165 
p£la=£la/165 
p£2a=£2a/165 
p£3a»£3a/ 165 

circle ( t*300/tmax, 60- (ptc-5000) *60/6000) , .1,1 

circle (t*300/tmax, 60- (pf la+p£2a+p£3a-50(JO) *50/6000} , .1,2 

circle ( t*3QQ/tmax , 120— (p£ la— 1600 ) *60/ 1600 ) ,.1,1 
circle (t*300/tmax, 120- (p£2a-1500) *60/1600} , .1,2 
circle ■ C*30Q/tmax, 120- (p£3a- 1500 ) *60/1600 ) , .1,3 

circle ( t*300/tmax , 180- ( dl ) *60 ) , . 1 , 1 
circle ( t*300/tmaz, 18G-(d2}*60} , .1,2 
circle t*300/tmax, 180- ( d3 ) *60 » , .1,3 


•rile output— 


cnncirl . t , inc : tc ■ , int ^ £la-f£ 2a*£3a'; , int ! f la ; , int ( £2a) , :nt ( £3a) , dl ,d2 ,d3 


ne:-: 


OiCSe r- 
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